CVE-2026-100867 (CVSS 3.3)

Description

spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh prompt. Attackers can embed ANSI/OSC escape sequences in version fields of package manifests to manipulate terminal output, rewrite window titles, or spoof displayed text when victims enter the directory.

Is your site exposed to CVE-2026-100867?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

3.3

LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS — Exploit Prediction

0.0012

Probability of exploitation

0.02%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-150 CWE-150

References

Other References

https://github.com/spaceship-prompt/spaceship-prompt https://github.com/spaceship-prompt/spaceship-prompt/blob/fd0d6653a134fe28f498eae1784fbb46d27f20f3/lib/section.zsh#L100-L102 https://github.com/spaceship-prompt/spaceship-prompt/blob/fd0d6653a134fe28f498eae1784fbb46d27f20f3/sections/package.zsh#L41 https://github.com/spaceship-prompt/spaceship-prompt/issues/1567 https://www.vulncheck.com/advisories/spaceship-prompt-through-4.22.5-terminal-escape-sequence-injection

Frequently Asked Questions

What is CVE-2026-100867? +

spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh prompt. Attackers can embed ANSI/OSC escape sequences in version fields of package manifests to manipulate terminal output, rewrite window titles, or spoof displayed text when victims enter the directory. It has a CVSS v3.1 base score of 3.3 (LOW).

How severe is CVE-2026-100867? +

CVE-2026-100867 has a CVSS v3.1 score of 3.3 out of 10, rated LOW. This is a low-severity vulnerability with limited impact. The EPSS score is 0.0012, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-100867? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-19591

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as …

CVE-2026-82710

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal …

CVE-2026-82584

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the …

CVE-2026-81856

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile …

CVE-2026-90895

Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies. …

CVE-2026-93421

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint …

CVE-2026-100867