Executive Summary

This vulnerability exists in Claude HUD versions up to 0.0.12, where the software constructs OSC 8 terminal hyperlink escape sequences using raw current working directory (cwd) and branchUrl values without properly stripping control characters or encoding embedded values.

Because of this, attackers can inject arbitrary ANSI codes into terminal sessions by embedding ESC+backslash sequences in the cwd or branch URL.

These malicious ANSI codes can cause effects such as changing text colors, forging prompts, writing to the clipboard via OSC 52 sequences, or triggering outbound HTTP requests to attacker-controlled servers when hyperlinks are clicked.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact users by allowing attackers to execute arbitrary ANSI escape sequences within terminal sessions.

• Visual deception through forged prompts or altered text colors, potentially misleading users.
• Unauthorized clipboard writes via OSC 52 sequences, which could lead to data leakage or injection.
• Triggering outbound HTTP requests to attacker-controlled servers when terminal hyperlinks are clicked, potentially exposing user activity or enabling further attacks.

Useful 0 Not Useful 0