{"id":"GO-2026-6270","revision":null,"records":[{"revision":"3c50a377c26c4c90bdfa2aab0fd56847","observedAt":"2026-10-29T19:28:49.708+00:00","statement":{"source":"cve-program","id":"CVE-2026-54162","aliases":[],"title":"Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUI","description":"Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row formatters pass Caddy access-log fields, particularly the request URI, through the `fitCellLeft` render helper without neutralizing terminal escape or control sequences. An unauthenticated remote client can place ANSI, OSC, or CSI control bytes in an ordinary HTTP request target. Caddy JSON-escapes those bytes, `ParseLogLine` decodes them back into raw controls, and the formatters concatenate them into `View()` output reaching `os.Stdout`. When the operator views the default `Logs` tab, the terminal interprets these sequences, allowing monitoring-dashboard spoofing, clipboard hijacking through `OSC 52`, and window-title spoofing through `OSC 0/2`. This works even with a loopback-only log listener because the input arrives through normal Caddy access logs. `Certificates` and `Routes` share secondary unneutralized render sinks. The `--json`, `--once`, and daemon `--expose` modes are unaffected because they do not render an interactive terminal. Consequences depend on the terminal emulator and usually require further operator action to escalate; this is not general-purpose remote code execution. This issue is fixed in version 1.4.2.","state":0,"publishedAt":"2026-10-28T19:44:41.999+00:00","modifiedAt":"2026-10-29T18:31:49.122+00:00","affected":[{"ecosystem":"Vendor product","name":"ember","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"alexandre-daubois\",\n                    \"product\": \"ember\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.4.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","score":4.7,"severity":"MEDIUM"}],"references":["https://github.com/alexandre-daubois/ember/security/advisories/GHSA-x3g7-qrwc-f6c5","https://github.com/alexandre-daubois/ember/commit/fcb7160e58dba58d6f9b5033cc312fdedc8c9f6b","https://github.com/alexandre-daubois/ember/releases/tag/v1.4.2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-54162","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-54162","identifiers":["CVE-2026-54162"]},"retained":false,"historicalAffected":[]},{"revision":"bcbb79760e7c440eb72cd8e946fd2ad8","observedAt":"2026-11-05T11:40:49.557+00:00","statement":{"source":"euvd","id":"EUVD-2026-112411","aliases":["CVE-2026-54162","GHSA-x3g7-qrwc-f6c5"],"title":"Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row formatters pass Caddy access-log fields, particularly the request URI, through the `fitCellLeft` render helper without ne…","description":"Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row formatters pass Caddy access-log fields, particularly the request URI, through the `fitCellLeft` render helper without neutralizing terminal escape or control sequences. An unauthenticated remote client can place ANSI, OSC, or CSI control bytes in an ordinary HTTP request target. Caddy JSON-escapes those bytes, `ParseLogLine` decodes them back into raw controls, and the formatters concatenate them into `View()` output reaching `os.Stdout`. When the operator views the default `Logs` tab, the terminal interprets these sequences, allowing monitoring-dashboard spoofing, clipboard hijacking through `OSC 52`, and window-title spoofing through `OSC 0/2`. This works even with a loopback-only log listener because the input arrives through normal Caddy access logs. `Certificates` and `Routes` share secondary unneutralized render sinks. The `--json`, `--once`, and daemon `--expose` modes are unaffected because they do not render an interactive terminal. Consequences depend on the terminal emulator and usually require further operator action to escalate; this is not general-purpose remote code execution. This issue is fixed in version 1.4.2.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","score":4.7,"severity":null}],"references":["https://github.com/alexandre-daubois/ember/security/advisories/GHSA-x3g7-qrwc-f6c5","https://github.com/alexandre-daubois/ember/commit/fcb7160e58dba58d6f9b5033cc312fdedc8c9f6b","https://github.com/alexandre-daubois/ember/releases/tag/v1.4.2"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-112411","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 28, 2026, 7:44:41 PM","dateUpdated":"Oct 29, 2026, 6:31:49 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-112411","identifiers":["EUVD-2026-112411","CVE-2026-54162","GHSA-x3g7-qrwc-f6c5"]},"retained":false,"historicalAffected":[]},{"revision":"7b88eae95a924d33aea818e63d256bdb","observedAt":"2026-10-31T15:05:16.691+00:00","statement":{"source":"nvd","id":"CVE-2026-54162","aliases":[],"title":"Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row formatters pass Caddy access-log fields, particularly the request URI, through the `fitCellLeft` render helper without ne…","description":"Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row formatters pass Caddy access-log fields, particularly the request URI, through the `fitCellLeft` render helper without neutralizing terminal escape or control sequences. An unauthenticated remote client can place ANSI, OSC, or CSI control bytes in an ordinary HTTP request target. Caddy JSON-escapes those bytes, `ParseLogLine` decodes them back into raw controls, and the formatters concatenate them into `View()` output reaching `os.Stdout`. When the operator views the default `Logs` tab, the terminal interprets these sequences, allowing monitoring-dashboard spoofing, clipboard hijacking through `OSC 52`, and window-title spoofing through `OSC 0/2`. This works even with a loopback-only log listener because the input arrives through normal Caddy access logs. `Certificates` and `Routes` share secondary unneutralized render sinks. The `--json`, `--once`, and daemon `--expose` modes are unaffected because they do not render an interactive terminal. Consequences depend on the terminal emulator and usually require further operator action to escalate; this is not general-purpose remote code execution. This issue is fixed in version 1.4.2.","state":0,"publishedAt":"2026-10-28T20:18:00.743+00:00","modifiedAt":"2026-10-29T19:17:22.213+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","score":4.7,"severity":"MEDIUM"}],"references":["https://github.com/alexandre-daubois/ember/commit/fcb7160e58dba58d6f9b5033cc312fdedc8c9f6b","https://github.com/alexandre-daubois/ember/releases/tag/v1.4.2","https://github.com/alexandre-daubois/ember/security/advisories/GHSA-x3g7-qrwc-f6c5"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54162","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-150"],"productCriteria":[],"sourceDates":{"published":"2026-10-28T20:18:00.743","lastModified":"2026-10-29T19:17:22.213"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-54162","identifiers":["CVE-2026-54162"]},"retained":false,"historicalAffected":[]},{"revision":"2696d02f365f4ab79055aab42f5b552c","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-x3g7-qrwc-f6c5","aliases":["CVE-2026-54162","GO-2026-6270"],"title":"Ember has unneutralized terminal escape/control sequences from Caddy logs injected into the operator's TUI","description":"## Summary\n\nEmber's interactive TUI renders fields taken from the monitored Caddy server's access logs — most notably the request URI — straight to the operator's terminal without neutralising terminal escape or control sequences (CWE-150). Those log fields are populated from arbitrary, unauthenticated HTTP requests, so any remote client can embed ANSI/OSC/CSI control bytes that the operator's terminal emulator interprets when the log row is displayed. The bytes survive the whole pipeline: Caddy escapes them into its JSON access log as unicode escapes, ember's `ParseLogLine` decodes them back to raw `0x1b`/`0x07` bytes, and the row formatters concatenate them into the bubbletea `View()` output with no encoding before they reach `os.Stdout`.\n\n## Impact\n\nAn **unauthenticated, remote** attacker who can send HTTP requests to the Caddy server that ember monitors can inject terminal escape sequences into the operator's TUI. The trigger is a single ordinary HTTP request with control bytes in the request target. It requires no authentication; because the payload is reflected through Caddy's normal access log, it works even when ember's log listener is bound only to loopback. When the operator views the Logs tab — ember's default, zero-config mode — the terminal emulator interprets the injected sequences. Broadly-supported, demonstrated impact includes:\n\n- **Monitoring-dashboard spoofing** — CSI cursor/erase/scroll sequences forge or hide log rows so the operator misjudges the monitored server's state.\n- **Clipboard hijacking (OSC 52)** — attacker-chosen text is written into the operator's system clipboard, staging a payload the operator may later paste into a shell.\n- **Window-title spoofing (OSC 0/2)** — to support social engineering.\n\nThe impact ceiling depends on the operator's terminal emulator and usually requires a further operator action (e.g. a paste) to fully escalate; this is not general-case RCE, though specific terminal emulators have historically escalated escape sequences further. The Certificates and Routes tabs share the same unneutralised render path as secondary sinks. The `--json`/`--once` and daemon (`--expose`) modes are not affected, as they do not render to an interactive terminal.\n\n## References\n\n- https://github.com/alexandre-daubois/ember/blob/main/internal/ui/logtable.go#L18 — the unneutralised render helper (`fitCellLeft`) and row formatters (the sink)\n- https://github.com/alexandre-daubois/ember/blob/main/internal/fetcher/lognetlistener.go — the unauthenticated TCP access-log listener (input source)\n- https://github.com/alexandre-daubois/ember/blob/main/internal/fetcher/logentry.go — `ParseLogLine`, where the JSON decode restores raw control bytes\n- https://cwe.mitre.org/data/definitions/150.html — CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences","state":0,"publishedAt":"2026-08-20T18:36:01+00:00","modifiedAt":"2026-09-10T03:50:54.2624358+00:00","affected":[{"ecosystem":"Go","name":"github.com/alexandre-daubois/ember","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.4.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/alexandre-daubois/ember/security/advisories/GHSA-x3g7-qrwc-f6c5","https://github.com/alexandre-daubois/ember/commit/fcb7160e58dba58d6f9b5033cc312fdedc8c9f6b","https://github.com/alexandre-daubois/ember","https://github.com/alexandre-daubois/ember/releases/tag/v1.4.2"],"sourceUrl":"https://github.com/advisories/GHSA-x3g7-qrwc-f6c5","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-x3g7-qrwc-f6c5","identifiers":["GHSA-x3g7-qrwc-f6c5","CVE-2026-54162","GO-2026-6270"]},"retained":false,"historicalAffected":[]},{"revision":"b37255ecd8dd4833abc1dc8b8b32b1c3","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6270","aliases":["CVE-2026-54162","GHSA-x3g7-qrwc-f6c5"],"title":"Ember has unneutralized terminal escape/control sequences from Caddy logs injected into the operator's TUI in github.com/alexandre-daubois/ember","description":"Ember has unneutralized terminal escape/control sequences from Caddy logs injected into the operator's TUI in github.com/alexandre-daubois/ember","state":0,"publishedAt":"2026-08-25T19:43:10+00:00","modifiedAt":"2026-08-26T01:21:30.7326793+00:00","affected":[{"ecosystem":"Go","name":"github.com/alexandre-daubois/ember","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.4.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/alexandre-daubois/ember/security/advisories/GHSA-x3g7-qrwc-f6c5","https://github.com/alexandre-daubois/ember/commit/fcb7160e58dba58d6f9b5033cc312fdedc8c9f6b","https://github.com/alexandre-daubois/ember/releases/tag/v1.4.2"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6270","license":"OSV · upstream source license applies","key":"osv:GO-2026-6270","identifiers":["GO-2026-6270","CVE-2026-54162","GHSA-x3g7-qrwc-f6c5"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T05:27:07.8967319+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T05:27:07.8967319+00:00","lastSuccessAt":"2026-11-07T05:27:08.0838193+00:00","error":null,"lastVerifiedAt":"2026-11-07T05:27:08.0838203+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-1ae829b4d87227681c503ae2aafcb6711759ec47373f516748aa4b8facbd6406","complete":true,"records":420508,"lastAttemptAt":"2026-11-07T05:27:06.834914+00:00","lastSuccessAt":"2026-11-07T05:27:06.7992637+00:00","error":null,"lastVerifiedAt":"2026-11-07T05:27:06.834914+00:00","snapshotPublishedAt":"2026-11-07T04:29:09+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-6c13c54d6d5b40f9b4f0bf38aff17b1f","complete":true,"records":13630,"lastAttemptAt":"2026-11-07T05:38:30.6955782+00:00","lastSuccessAt":"2026-11-07T05:38:30.691+00:00","error":null,"lastVerifiedAt":"2026-11-07T05:38:30.691+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T05:27:07.8967319+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T05:27:07.8967319+00:00","lastSuccessAt":"2026-11-07T05:27:08.0851849+00:00","error":null,"lastVerifiedAt":"2026-11-07T05:27:08.0851858+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-34343b4ea57e47c5a482c8fcf20a381e","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T05:27:08.6678996+00:00","lastSuccessAt":"2026-11-07T01:26:55.938+00:00","error":null,"lastVerifiedAt":"2026-11-07T01:26:55.938+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T05:27:07.4567342+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T05:27:07.4567342+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T05:27:06.8856537+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T05:27:06.8856537+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T05:27:07.8404874+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T05:27:07.8404874+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-a0b728bc1c5526b5429930c00621636eba8655069c176697c3080f8377619ad7","complete":true,"records":231291,"lastAttemptAt":"2026-11-07T05:27:07.3565884+00:00","lastSuccessAt":"2026-11-07T00:28:51.1983528+00:00","error":null,"lastVerifiedAt":"2026-11-07T05:27:07.3565884+00:00","snapshotPublishedAt":"2026-11-06T23:33:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}