CyberRota Analysis
AI-GeneratedSpaceship-prompt versions up to 4.22.5 are vulnerable due to inadequate sanitization of control characters in project manifest version fields, allowing attackers to inject ANSI/OSC escape sequences. This can lead to manipulated terminal output, altered window titles, or spoofed text display when users navigate to the affected directory. Developers and system administrators using this prompt should prioritize addressing this vulnerability to prevent potential user deception and terminal manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh prompt. Attackers can embed ANSI/OSC escape sequences in version fields of package manifests to manipulate terminal output, rewrite window titles, or spoof displayed text when victims enter the directory.