Terminal Escape Sequence Injection Vulnerability in npm-check-updates by Raineorshine

CVE-2026-73035

What is CVE-2026-73035?

The npm-check-updates tool prior to version 23.0.3 is vulnerable to a terminal escape sequence injection, which allows attackers to inject arbitrary terminal control characters through unsanitized inputs in the package.json homepage or repository URL fields. When developers execute ncu with the --format homepage or --format repo options, these escape sequences can be written unfiltered to the terminal. This manipulation could lead to malicious output effects, potentially exploiting terminal-specific functions, which poses a significant risk to developers who rely on this tool to manage dependencies effectively.

References