🛡️ CVE-2026-50642

⚪ Unknown ✅ No Known Exploit CWE-116 NVD
N/A
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences while allowing other control characters, including carriage return (\r) and escape sequences (e.g., OSC, CSI), to pass through unsanitized.

An attacker can embed malicious control sequences in filenames, diff metadata, or file content that are rendered directly in the terminal during diff viewing. This can lead to output manipulation, including filename spoofing, terminal screen clearing, and clipboard injection via supported escape sequences.

Successful exploitation may mislead users during code review, alter terminal state, or result in unintended command execution through clipboard hijacking.

This issue has been fixed in the commit 9c81294

Weakness class

CVE-2026-50642 is classified as CWE-116: Improper Encoding or Escaping of Output. Output is emitted without encoding it for the context it lands in, so data is interpreted as markup or code.

Affected software

CVE-2026-50642 is recorded against 1 package.

  • unknown

Timeline and source

Published on 29 July 2026 and last revised on 30 July 2026. No public exploit is currently recorded for this entry. Record sourced from NVD.

References

cert.pl
github.com

Details

Severity Unknown
CVSS Score N/A
CVSS Vector N/A
CWE CWE-116
Public Exploit ✅ No
Source NVD
Published 2026-07-29
Updated 2026-08-11
Modified 2026-07-30
Fix URL N/A

Affected Packages

Software From version Fixed in
unknown — —

Similar Threats

Free Vulnerability Check

Is your site affected by CVE-2026-50642?

BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against CVE-2026-50642 and other known CVE records.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.