GHSA-8QX3-8GM5-9CJ2: Terminal Escape-Sequence Injection in pickem
Vulnerability ID: GHSA-8QX3-8GM5-9CJ2
CVSS Score: 7.8
Published: 2026-08-25
The npm package 'pickem' is vulnerable to a terminal escape-sequence injection (CWE-150). Unsanitized terminal outputs allow attackers to execute arbitrary shell commands via clipboard hijacking (OSC 52) or manipulate terminal displays through Control Sequence Introducers (CSI).
TL;DR
Unsanitized rendering of user input in the 'pickem' library allows attackers to inject terminal escape sequences, potentially leading to remote code execution through clipboard hijacking (OSC 52).
Technical Details
- CWE ID: CWE-150
- Attack Vector: Local / Network-Adjacent (via external inputs like branch names or PR titles)
- CVSS v3.1 Score: 7.8
- EPSS Score: N/A
- Exploit Status: Proof of Concept (PoC) available in official unit tests
- CISA KEV Status: Not Listed
Affected Systems
- CLI tools using the pickem library
- Node.js CLI environments with user-supplied prompts
Mitigation Strategies
- Upgrade the pickem package to version 1.0.7 or later
- Filter user-controllable input strings for non-printable control characters
- Disable OSC 52 clipboard write features in terminal emulator configurations if not strictly required
Remediation Steps:
- Run 'npm install pickem@latest' to update the local package dependency
- Audit CLI applications to verify that rendering inputs are passed through the sanitizeDisplay utility
- Employ static code analysis to search for output components that write unsanitized variables to stdout
References
- GitHub Advisory GHSA-8QX3-8GM5-9CJ2
- GitHub Repository for pickem-oss
- pickem-oss v1.0.7 Release Details
Read the full report for GHSA-8QX3-8GM5-9CJ2 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)