Loading story…
CVE-2026-50642 affects all versions of diff-so-fancy through 1.4.10, exposing users to terminal escape injection when viewing diffs. CERT Polska reported that the tool strips only ANSI SGR sequences but fails to sanitize other control characters, including carriage returns and escape sequences such as OSC and CSI. An attacker can embed malicious sequences in filenames, diff metadata, or file contents so they are rendered directly in a victim's terminal during code review or diff inspection.
The flaw can be used to spoof filenames, clear terminal output, alter terminal state, inject clipboard content, and mislead reviewers; CERT Polska also warned that clipboard hijacking could contribute to unintended command execution. The issue was fixed in commit 9c81294 following coordinated disclosure, and the report credited Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CERT Polska published details of CVE-2026-50642, an improper sanitization flaw in diff-so-fancy affecting all versions through 1.4.10. The vulnerability allows terminal control sequences in filenames, diff metadata, or file contents to be rendered and abused for output manipulation and related attacks.
The issue was remediated in commit 9c81294 following coordinated disclosure. CERT Polska credited Michał Majchrowicz and Marcin Wyczechowski from the AFINE Team with the responsible disclosure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CERT Polska disclosed an **integer overflow** vulnerability in **GNU diffutils**, tracked as `CVE-2026-53910`. The issue affects the widely used file-comparison utility suite and was published as a security notice identifying the flaw in the software. A follow-on report amplified the disclosure and confirmed that the core issue is the integer overflow in GNU diffutils, pointing back to the CERT Polska advisory as the primary source. Organizations using GNU diffutils should review the vendor and CERT guidance, identify affected deployments, and prioritize patching or other mitigations once updates are available.
Jul 22, 2026
CERT Polska disclosed three vulnerabilities in **GNU cpio** affecting versions through **2.15**, tracked as `CVE-2026-66484`, `CVE-2026-66485`, and `CVE-2026-66486`. The issues were reported by researchers from the **AFINE Team** and fixed in upstream commits. The most serious flaw allows **path traversal** during archive extraction, a weakness aligned with `CWE-22`, in which crafted file paths can escape the intended extraction directory and potentially overwrite or access files outside the restricted path. The additional bugs include an **uncontrolled memory allocation** issue mapped to `CWE-789` that can trigger a **stack overflow** and denial of service, and an **improper output escaping** flaw that can produce forged archive listings or inject terminal escape sequences. Together, the vulnerabilities expose users handling untrusted archives to file-system compromise, service disruption, and deceptive terminal output, underscoring the risk of insufficient pathname validation, unsafe memory handling, and unescaped archive metadata in command-line archive tools.
Aug 10, 2026
Apple disclosed that **macOS Tahoe 26.1** fixed a Terminal issue that allowed ANSI escape sequences in rendered output to trigger DNS requests, creating a path for data exfiltration when attacker-controlled content was displayed in the terminal. The flaw was reported in December 2024 and was later documented in Apple's broader macOS security bulletin, which lists numerous fixes across privacy protections, sandboxing, privilege boundaries, memory safety, Gatekeeper restrictions, and denial-of-service conditions. A public write-up showed how the behavior could be abused through an LLM-enabled CLI workflow: malicious spreadsheet content influenced the model's output, which included escape codes that **macOS Terminal** interpreted as DNS lookups carrying stolen data. The researcher said the issue demonstrates that terminal-rendered model output must be treated as untrusted input, while Apple's bulletin indicates the fix shipped in Tahoe 26.1 alongside many other vulnerability patches affecting both Apple components and some bundled third-party open-source software.
Jul 17, 2026