CVE-2026-72847
Received Received - Intake

Terminal Escape Sequence Injection in broot File Browser

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: VulnCheck

Description
broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain to_string_lossy() call in src/tree_build/builder.rs and in TreeLine::unprune in src/tree/tree_line.rs, and no control-character filtering exists anywhere in the code, even though the doc comment on the TreeLine name field states that some characters may have been stripped. Any local user who can create a file can therefore place an escape sequence in its name and have it written unmodified to the terminal of anyone who browses that directory, between broot's own styling codes. A reported proof of concept used an OSC 52 clipboard-write sequence and captured the raw bytes broot wrote to its pty, confirming the sequence reaches the terminal unstripped. What an injected OSC or CSI sequence can then do depends on the terminal emulator in use. Browsing a directory is broot's primary function and carries no expectation that the content is trusted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-72847
EUVD
EUVD-2026-63488

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
canop broot 1.58.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-150 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-72847 is a terminal escape sequence injection vulnerability in broot, a file manager tool. It occurs because broot displays file and directory names exactly as read from the filesystem without filtering control characters or escape sequences. Attackers can create malicious filenames containing terminal control sequences, which broot then writes unmodified to the terminal. This allows arbitrary terminal behavior manipulation when users browse directories.

Detection Guidance

Check for broot version 1.58.0 or earlier using 'broot --version'. Inspect directories for filenames containing control characters or escape sequences like OSC 52. Use 'ls -la' to list files and look for unusual names.

Impact Analysis

If exploited, this vulnerability could allow attackers to manipulate your terminal session. For example, an attacker could craft a filename containing a clipboard-write sequence (OSC 52) that copies sensitive data from your clipboard without your knowledge. Other terminal control sequences could execute arbitrary commands, alter terminal behavior, or capture keystrokes depending on your terminal emulator.

Compliance Impact

This vulnerability could lead to data breaches by enabling clipboard manipulation or command execution, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using broot in regulated environments may face compliance violations if attackers exploit this flaw to access or exfiltrate sensitive data.

Mitigation Strategies

Upgrade broot to a patched version (post v1.58.0) where escape sequences are sanitized. Avoid browsing directories with untrusted files using broot until updated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72847. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart