OCTOBER 13, 2026
Live Feed
Back to database
Case File

CVE-2026-100866

LOW · CVSS 3.3 EPSS 0.13% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-27 · Last synced 2026-10-13

CyberRota Analysis

AI-Generated

Onefetch versions up to 2.28.1 are vulnerable to terminal escape sequence injection due to the improper handling of control characters in repository information fields. This flaw allows attackers to manipulate terminal output, potentially leading to misleading information display or unauthorized command execution when victims use the tool. Developers and users of onefetch should prioritize this vulnerability to mitigate the risk of exploitation in their terminal environments.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-100866
Severity
LOW
CVSS
3.3
EPSS
0.13%

Original NVD Description

onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest version and name fields to manipulate terminal output, rewrite window titles, hide text, or trigger emulator-specific behavior when victims run onefetch.