Improper Escape Handling in Nushell's Data Conversion Component
CVE-2026-124992

4.8MEDIUM

Key Information:

Vendor

Nushell

Status
Nushell
Vendor
CVE Published:
9 November 2026

What is CVE-2026-124992?

A local vulnerability exists in Nushell, specifically in the Data Conversion Handler's escape_bytes function within the ser.rs file. This issue arises from improper handling of escape, meta, or control sequences, potentially allowing malicious actors to influence data processing. A fix for this vulnerability is currently pending acceptance, emphasizing the need for users to monitor and apply updates promptly to mitigate risks associated with this flaw.

Affected Version(s)

nushell 0.116.0

nushell 0.116.1

References

https://vuldb.com/vuln/433164
vdb-entrytechnical-description
https://vuldb.com/vuln/433164/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-124992
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

carfeii (VulDB User)
VulDB CNA Team
.