Terminal Escape Sequence Injection in Onefetch

Executive Summary

This vulnerability is a terminal escape sequence injection in onefetch versions up to 2.28.1. It occurs when the tool writes repository information like version or name fields to the terminal without removing control characters. Attackers can embed ANSI or OSC escape sequences in these fields to manipulate terminal output, rewrite window titles, hide text, or trigger emulator-specific behavior when victims run onefetch.

Useful 0 Not Useful 0

Detection Guidance

Check if onefetch version 2.28.1 or earlier is installed by running: onefetch --version. If installed, inspect repository manifest files (e.g., package.json, Cargo.toml) for fields like version or project name containing escape sequences. Use grep to search for ANSI/OSC sequences in these files: grep -P "\x1b|\x9d" package.json Cargo.toml.

Useful 0 Not Useful 0

Impact Analysis

If you use onefetch versions up to 2.28.1, an attacker could trick you into running the tool on a malicious repository. This might allow them to alter your terminal display, hide important information, or even execute arbitrary actions through terminal emulator vulnerabilities. The impact depends on your terminal emulator and system configuration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. The issue involves terminal escape sequence injection in onefetch, which could allow attackers to manipulate terminal output or behavior. However, there is no evidence that this vulnerability leads to unauthorized data access, disclosure, or other violations of compliance requirements in these standards.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade onefetch to the latest version beyond 2.28.1. If upgrading is not possible, avoid running onefetch on untrusted repositories or sanitize manifest files manually to remove control characters before use.

Useful 0 Not Useful 0