CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences

openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint

pickem vulnerable to terminal escape-sequence injection via unsanitized item text

Ember has unneutralized terminal escape/control sequences from Caddy logs injected into the operator's TUI

Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data

Shescape: Shell injection via unescaped parentheses on Windows with CMD

GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injection

Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences

OpenClaw has ACP CLI approval prompt ANSI escape sequence injection

Inspektor Gadget uses unsanitized ANSI Escape Sequences In `columns` Output Mode

Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences

AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters

Mailpit has an SMTP Header Injection via Regex Bypass

badkeys vulnerable to ASCII control character injection on console via malformed input

Soft Serve does not sanitize ANSI escape sequences in user input

Apache Tomcat Rewrite rule bypass

Tracing logging user input may result in poisoning logs with ANSI escape sequences

Active Record logging vulnerable to ANSI escape injection

Gardener allows metadata injection for a project secret which can lead to privilege escalation

gurk (aka gurk-rs) mishandles ANSI escape sequences

MongoDB Shell may be susceptible to control character Injection via shell output

MongoDB Shell may be susceptible to control character injection via pasting

Crayfish allows Remote Code Execution via Homarus Authorization header

Crayfish Allows Remote Code Execution via hypercube X-Islandora-Args Header