Spaceship-Prompt Terminal Manipulation via Malicious Manifest Version

Executive Summary

This vulnerability in spaceship-prompt through version 4.22.5 allows attackers to inject ANSI or OSC escape sequences into package manifest version fields. These sequences are not sanitized before being rendered in the zsh prompt, enabling manipulation of terminal output, window titles, or displayed text when users enter a directory with a malicious manifest.

Useful 0 Not Useful 0

Detection Guidance

Check package manifests like package.json or Cargo.toml for version fields containing ANSI/OSC escape sequences. Use grep to search for control characters in version strings: grep -r $'\x1b\[' . or grep -r $'\x1c' .

Inspect spaceship-prompt configuration files for unfiltered dynamic content rendering. Review section.zsh and package.zsh for improper sanitization of version fields.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to alter terminal output, change window titles, or spoof displayed text. This might lead to confusion, misdirection, or even facilitate further attacks by tricking users into executing unintended commands.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly impact GDPR or HIPAA compliance as it primarily affects terminal output manipulation rather than data privacy or security controls. However, if malicious actors exploit this to deceive users into executing unintended commands, it could indirectly lead to unauthorized data access or actions violating compliance requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade spaceship-prompt to the latest version beyond 4.22.5 where escape sequences are sanitized. Apply patches from the official repository if available.

Manually sanitize version fields in package manifests by removing ANSI/OSC escape sequences before rendering. Implement input validation in scripts handling dynamic content.

Useful 0 Not Useful 0