CVE-2026-73035

Received Received - Intake

npm-check-updates Terminal Escape Sequence Injection

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: VulnCheck

Description

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --format homepage or --format repo option, unfiltered escape sequences are written directly to the terminal, enabling malicious output manipulation or other terminal-dependent effects.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-73035

EUVD

EUVD-2026-55804

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-150	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is a terminal escape sequence injection in npm-check-updates through version 23.0.2. An attacker can embed malicious terminal control characters in a dependency's package.json homepage or repository URL fields. When developers run ncu with specific formatting options like --format homepage or --format repo, these unfiltered escape sequences are written directly to the terminal, potentially manipulating terminal output or causing other terminal-dependent effects.

Detection Guidance

Check if npm-check-updates version 23.0.2 or earlier is installed. Run 'ncu --version' to verify. Inspect package.json files for dependencies with malicious homepage or repository URLs containing terminal escape sequences.

Impact Analysis

If you use npm-check-updates with vulnerable versions and run commands with --format homepage or --format repo, an attacker could manipulate your terminal output. This might lead to misleading information display, potential execution of arbitrary commands if terminal escape sequences are misused, or confusion during dependency updates.

Mitigation Strategies

Update npm-check-updates to the latest version with the fix (commit b554b84 or later). Avoid using --format homepage or --format repo options until updated. Review and sanitize package.json files for suspicious URLs.

Hi! I’m here to help you understand CVE-2026-73035. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70