GO-2026-6270Published
Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUI
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-54162 · Microsoft / collected KEV context
cve-program · CVE-2026-54162
- https://github.com/alexandre-daubois/ember/security/advisories/GHSA-x3g7-qrwc-f6c5
- https://github.com/alexandre-daubois/ember/commit/fcb7160e58dba58d6f9b5033cc312fdedc8c9f6b
- https://github.com/alexandre-daubois/ember/releases/tag/v1.4.2
euvd · EUVD-2026-112411
- https://github.com/alexandre-daubois/ember/security/advisories/GHSA-x3g7-qrwc-f6c5
- https://github.com/alexandre-daubois/ember/commit/fcb7160e58dba58d6f9b5033cc312fdedc8c9f6b
- https://github.com/alexandre-daubois/ember/releases/tag/v1.4.2
nvd · CVE-2026-54162
- https://github.com/alexandre-daubois/ember/commit/fcb7160e58dba58d6f9b5033cc312fdedc8c9f6b
- https://github.com/alexandre-daubois/ember/releases/tag/v1.4.2
- https://github.com/alexandre-daubois/ember/security/advisories/GHSA-x3g7-qrwc-f6c5
osv · GHSA-x3g7-qrwc-f6c5
- https://github.com/alexandre-daubois/ember/security/advisories/GHSA-x3g7-qrwc-f6c5
- https://github.com/alexandre-daubois/ember/commit/fcb7160e58dba58d6f9b5033cc312fdedc8c9f6b
- https://github.com/alexandre-daubois/ember
- https://github.com/alexandre-daubois/ember/releases/tag/v1.4.2
osv · GO-2026-6270
Related operational evidence
Explicit CVE identifiers- Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row formatters pass Caddy access-log fields, particularly the request URI, through the `fitCellLeft` render helper without ne… · Advisory content revised · 31 Oct 2026
- Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUI · Newly collected advisory · 28 Oct 2026