CVE-2026-82710
Received Received - Intake

Terminal Control Sequence Injection in Mix Usage Rules

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: EEF

Description
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal control sequences into the output of mix usage_rules.search_docs. mix usage_rules.search_docs searches Hex documentation through search.hexdocs.pm, which indexes the documentation of every published package, and prints the matching results (title, package, type, doc reference, and highlighted snippets) to the terminal. The formatter in Mix.Tasks.UsageRules.SearchDocs interpolated those publisher-controlled fields verbatim, neutralizing no terminal control characters; the only transform it applied adds escape sequences rather than removing them. A malicious package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) in its indexed documentation, so when a developer runs a search that surfaces those docs the sequences reach the terminal unchanged — forging the displayed hexdocs URL or a suggested command, hiding text, or writing to the clipboard. No authentication or privileged position is required; only publishing a package. This issue affects usage_rules: from 0.1.18 before 1.2.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-08
Last Modified
2026-09-08
Generated
2026-09-08
AI Q&A
2026-09-08
EPSS Evaluated
N/A
NVD
CVE-2026-82710
EUVD
EUVD-2026-72589

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ash-project usage_rules From 0.1.18 (inc) to 1.2.8 (exc)
elixir usage_rules From 0.1.18 (inc) to 1.2.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-150 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a terminal escape sequence injection vulnerability in the usage_rules package for Elixir. It affects versions between 0.1.18 and 1.2.7. When developers run the mix usage_rules.search_docs command, it retrieves and displays Hex documentation metadata without sanitizing terminal control characters. A malicious package publisher can embed ANSI escape sequences in their package's documentation, which execute when the search command runs. This could forge output, hide text, or manipulate the clipboard.

Detection Guidance

Check if your system has the vulnerable usage_rules package versions (0.1.18 to 1.2.7) installed by running: mix deps | grep usage_rules. If installed, verify the version with mix deps.get and compare against 1.2.8 or later.

Impact Analysis

If you run mix usage_rules.search_docs in a vulnerable terminal, a malicious package could alter displayed URLs, hide search results, or write sensitive data to your clipboard without your knowledge. This requires only that you search for documentation of a malicious package.

Compliance Impact

This vulnerability does not directly impact GDPR or HIPAA compliance as it primarily affects terminal output display and developer tooling rather than data protection or privacy controls. The issue involves terminal escape sequence injection in a developer tool, which could manipulate displayed content or clipboard operations but does not inherently expose, alter, or leak sensitive data governed by these regulations.

Mitigation Strategies

Update the usage_rules package to version 1.2.8 or later using mix deps.update usage_rules. Avoid running mix usage_rules.search_docs until updated. Review package documentation for suspicious ANSI escape sequences before installation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82710. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart