CVE-2026-90773
procs through 0.14.12 Terminal Escape Sequence Injection via Command
- State
- Published
- Severity
- 2.4 Low
- Published
- Sep 13, 2026
- Updated
- Sep 24, 2026
- Reserved
- Sep 13, 2026
Description
procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute processes with malicious ANSI or OSC escape sequences in their command line arguments, which are written unmodified to other users' terminals for interpretation by terminal emulators.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.4 Low | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N | VulnCheck |
| 3.1 | 3.2 Low | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N | VulnCheck |
Weaknesses
- CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences
Affected Products
| Product | Versions |
|---|---|
procsdalance |
|
References
- GitHub Issue #950issue-tracking
- https://github.com/dalance/procsproduct
- https://github.com/dalance/procs/blob/v0.14.12/src/columns/command.rstechnical-description
- https://github.com/dalance/procs/commit/a064cec7d59f69a636d38e247824245dcd3a9836patch
- VulnCheck Advisory: procs through 0.14.12 Terminal Escape Sequence Injection via Commandthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.