Output Manipulation Flaw in diff-so-fancy by so-fancy

CVE-2026-50642

What is CVE-2026-50642?

The diff-so-fancy application has a vulnerability that arises from its failure to properly sanitize non-SGR terminal control sequences before displaying diff data. Although the application effectively strips ANSI SGR sequences, it permits other control characters—including carriage returns and various escape sequences—to be processed unsanitized. This vulnerability enables an attacker to insert malicious control sequences into filenames, diff metadata, or file contents, which can be executed during viewing in the terminal. Such exploitation can facilitate output manipulation, allowing for misleading filename representation, terminal state alteration, or clipboard hijacking, thereby potentially compromising user operations during critical code reviews.

References