Low severity3.3NVD Advisory· Published Sep 27, 2026
CVE-2026-100867
CVE-2026-100867
Description
spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh prompt. Attackers can embed ANSI/OSC escape sequences in version fields of package manifests to manipulate terminal output, rewrite window titles, or spoof displayed text when victims enter the directory.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=4.22.5
Patches
Vulnerability mechanics
References
4- github.com/spaceship-prompt/spaceship-prompt/blob/fd0d6653a134fe28f498eae1784fbb46d27f20f3/lib/section.zshnvd
- github.com/spaceship-prompt/spaceship-prompt/blob/fd0d6653a134fe28f498eae1784fbb46d27f20f3/sections/package.zshnvd
- github.com/spaceship-prompt/spaceship-prompt/issues/1567nvd
- www.vulncheck.com/advisories/spaceship-prompt-through-4.22.5-terminal-escape-sequence-injectionnvd
News mentions
0No linked articles in our index yet.