Full Report
Improper Encoding or Escaping of Output vulnerability (CVE-2026-50642) has been found in diff-so-fancy software.
Analysis Summary
# Vulnerability: Terminal Control Sequence Injection in diff-so-fancy
## CVE Details
- **CVE ID**: CVE-2026-50642
- **CVSS Score**: Not explicitly provided in the source (Estimated Medium/High based on impact)
- **CWE**: CWE-116 (Improper Encoding or Escaping of Output)
## Affected Systems
- **Products**: diff-so-fancy
- **Versions**: All versions through 1.4.10
- **Configurations**: Default installations used to render diffs containing malicious file metadata or content in a terminal emulator.
## Vulnerability Description
The `diff-so-fancy` software fails to properly sanitize non-SGR (Select Graphic Rendition) terminal control sequences. While the application attempts to strip standard ANSI color sequences, it allows other dangerous control characters to pass through to the terminal, specifically:
- Carriage returns (`\r`)
- Operating System Command (`OSC`) sequences
- Control Sequence Introducer (`CSI`) sequences
When a user views a specially crafted diff, these sequences are rendered by the terminal emulator rather than displayed as literal text.
## Exploitation
- **Status**: PoC existence implied (reported by security researchers); no confirmed active exploitation in the wild mentioned.
- **Complexity**: Low
- **Attack Vector**: Local/Network (via malicious files in a repository or pull request)
## Impact
- **Confidentiality**: Low (Information may be hidden/obfuscated)
- **Integrity**: High (Output manipulation allows for filename spoofing, misleading code reviews, and potential clipboard hijacking via terminal escape sequences)
- **Availability**: Low (Can trigger terminal screen clearing or alter terminal state)
## Remediation
### Patches
- The issue has been addressed in the source code via **commit 9c81294**. Users should update to the latest version of `diff-so-fancy` released after July 29, 2026.
### Workarounds
- Use terminal emulators that allow disabling dangerous escape sequences (e.g., disabling "allow OSC 52 to set clipboard").
- Avoid using `diff-so-fancy` to review untrusted/unvetted commits until the patch is applied.
## Detection
- **Indicators of Compromise**: Presence of unexpected escape sequences or carriage returns in source code files, particularly within filenames or "diff" metadata.
- **Detection Methods**: Inspecting raw patches or files with `cat -v` to reveal hidden non-printable characters and escape sequences before running them through `diff-so-fancy`.
## References
- **Vendor Advisory**: hxxps[://]github[.]com/so-fancy/diff-so-fancy/commit/9c81294
- **CERT Polska Advisory**: hxxps[://]cert[.]pl/en/advisories/CVE-2026-50642 (Defanged)
- **CVE Record**: hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-50642