Terminal Escape Sequence Injection in Spaceship Prompt by Spaceship

CVE-2026-100867

What is CVE-2026-100867?

The vulnerability in Spaceship Prompt, present in versions up to 4.22.5, arises from insufficient sanitization of control characters in project manifest version fields. Attackers can exploit this flaw by injecting ANSI/OSC escape sequences, which can alter terminal outputs, rewrite window titles, or spoof text displays when victims navigate into affected directories. This manipulation presents a potential security risk, allowing malicious actors to deceive users and compromise terminal integrity.

References