CVE-2026-82584

Received Received - Intake

Forgeable Confirmation Panel in Igniter via ANSI Escape Sequences

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: EEF

Description

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel (an anti-typosquatting safeguard) listing a package's hex metadata before adding it. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields (meta.description, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency. This issue affects igniter: from 0.8.1 before 0.8.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-07

Last Modified

2026-09-07

Generated

2026-09-08

AI Q&A

2026-09-08

EPSS Evaluated

N/A

NVD

CVE-2026-82584

Affected Vendors & Products

Vendor	Product	Version / Range
ash-project	igniter	From 0.8.1 (inc) to 0.8.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-150	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper neutralization of escape sequences in the ash-project igniter tool. A malicious package publisher can forge the mix igniter.install confirmation prompt by embedding ANSI terminal escape sequences in package metadata. This allows them to overwrite the displayed panel, deceiving developers into approving a malicious dependency.

Detection Guidance

This vulnerability involves forged confirmation prompts in the mix igniter tool due to improper handling of terminal escape sequences. Detection requires checking for packages with metadata containing ANSI escape sequences or unusual characters in publisher fields. Review installed packages for versions of igniter between 0.8.1 and 0.8.3.

Impact Analysis

If you use the affected versions of igniter (0.8.1 to 0.8.3), a malicious package could trick you into installing it by forging the confirmation prompt. This could lead to installing harmful dependencies, compromising your system or project security without your knowledge.

Compliance Impact

This vulnerability could potentially impact compliance with standards like GDPR and HIPAA by enabling malicious actors to deceive developers into installing compromised dependencies. By forging confirmation prompts, attackers could trick developers into approving malicious packages, which might lead to unauthorized data access or breaches of confidentiality.

Mitigation Strategies

Upgrade igniter to version 0.8.4 or later immediately. Avoid installing packages with suspicious metadata or unverified publishers. Inspect existing dependencies for signs of tampering, such as unexpected terminal behavior during installation.

Hi! I’m here to help you understand CVE-2026-82584. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70