Loading story…
jqwik, a property-based testing framework for JUnit 5, addressed a security issue in its 1.10 release line involving malicious test output that could manipulate terminal display and potentially mislead AI-assisted development tools. The reported behavior used ANSI escape sequences such as \u001B[2K\u001B[2K to hide or alter visible console content, creating a prompt-injection-style risk when test results were consumed by coding agents or other automated assistants.
Maintainers published guidance indicating the issue is especially relevant in workflows where developers feed test output into AI systems for debugging or code generation. Users were advised to upgrade to a fixed jqwik version in the 1.10 branch to prevent terminal output from being used as a vehicle for deceptive instructions or concealed content in AI-driven development environments.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The issue was addressed by jqwik maintainers in the 1.10 release line, and guidance was published advising users to update to a fixed version.
A security issue in jqwik 1.10.0 was described in which test output could include ANSI escape sequences such as "\u001B[2K\u001B[2K" to manipulate or hide terminal content, creating a prompt-injection style risk in AI-assisted development workflows.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceopennet.ru
Open sourceopennet.me
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
jqwik maintainer Johannes Link released version **1.10.0** with a hidden prompt injection embedded in `net.jqwik.engine.execution.JqwikExecutor` via `printMessageForCodingAgents()`, causing the test engine to prepend an instruction telling AI coding agents to disregard prior directions and delete all jqwik tests and code. The payload used ANSI escape sequences to conceal the line from normal terminal viewers while leaving it visible in raw `stdout`, logs, and machine-parsed output, creating a new kind of software supply chain risk for CI/CD pipelines and agentic development tools that ingest test results. The release triggered public backlash after developers and security researchers warned that the concealed instruction targeted user-created code and could be executed by weaker agents even if at least one major tool, **Claude Code**, reportedly detected and refused it. Critics including Ramon Batllet and runZero founder **HD Moore** called the tactic destructive and ethically questionable, while Link updated the release notes to disclose the behavior, said jqwik was not intended for AI-agent use, and later shipped **1.10.1** with a softened message and opt-in hiding behavior as debate spread over package registry policy, maintainer conduct, and how intentional prompt injection in open-source packages should be classified.
Jun 29, 2026
**CVE-2026-50642** affects all versions of `diff-so-fancy` through `1.4.10`, exposing users to terminal escape injection when viewing diffs. CERT Polska reported that the tool strips only ANSI SGR sequences but fails to sanitize other control characters, including carriage returns and escape sequences such as **OSC** and **CSI**. An attacker can embed malicious sequences in filenames, diff metadata, or file contents so they are rendered directly in a victim's terminal during code review or diff inspection. The flaw can be used to spoof filenames, clear terminal output, alter terminal state, inject clipboard content, and mislead reviewers; CERT Polska also warned that clipboard hijacking could contribute to unintended command execution. The issue was fixed in commit `9c81294` following coordinated disclosure, and the report credited Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team.
Jul 30, 2026
Open WebUI disclosed and fixed **CVE-2026-70492**, a high-severity stored cross-site scripting flaw affecting versions `0.10.0` through before `0.11.0`. The bug was traced to `src/lib/components/chat/Messages/Markdown/KatexRenderer.svelte`, where KaTeX rendering failures could cause the application to insert the original math source into the page through an unescaped `{@html}` path instead of safely rendering it as text. The vulnerability is rated **CVSS 8.7** and classified as **CWE-79**. An attacker able to submit a crafted chat message could trigger script execution in the browser of anyone viewing the message, including users in shared chats and channels, creating a path to steal session tokens from `localStorage` and potentially take over administrator accounts. The issue was reachable through normal message rendering, including malformed or deeply nested brace input that caused non-`ParseError` KaTeX failures such as `RangeError`. Open WebUI addressed the flaw by escaping the fallback content rather than injecting it as HTML, and the fix was merged under pull request **#26718** before release in version `0.11.0`.
Aug 5, 2026