CVE-2025-54389: Terminal Escape Injection Via Filename
Filenames, optarg values, and similar string properties may contain control characters (like ANSI escape sequences). Printing them directly to standard output or log channels without sanitization exposes terminal emulators to injection attacks (CWE-150 / CWE-117). This allows an attacker to disguise or tamper with log contents. Always pass potentially untrus
Cgreprules fetch cve-2025-54389-terminal-escape-injection-via-filename --engine opengrepDescription
Filenames, optarg values, and similar string properties may contain control characters (like ANSI escape sequences). Printing them directly to standard output or log channels without sanitization exposes terminal emulators to injection attacks (CWE-150 / CWE-117). This allows an attacker to disguise or tamper with log contents. Always pass potentially untrus
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.