CyberRota Analysis
AI-GeneratedThe vulnerability allows attackers to inject arbitrary terminal control characters into the homepage or repository URL fields of a dependency's package.json file in npm-check-updates versions up to 23.0.2. When developers use the tool with specific formatting options, these unfiltered escape sequences can lead to malicious output manipulation or other harmful effects in the terminal. Developers and organizations using npm-check-updates should prioritize patching this vulnerability to mitigate potential risks associated with terminal command execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --format homepage or --format repo option, unfiltered escape sequences are written directly to the terminal, enabling malicious output manipulation or other terminal-dependent effects.