CVE-2026-73035

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73035
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73035.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73035
Published
2026-08-10T20:19:40Z
Modified
2026-08-13T03:51:51Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
npm-check-updates 23.0.2 Terminal Injection via Unsanitized Escape Sequences
Details

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --format homepage or --format repo option, unfiltered escape sequences are written directly to the terminal, enabling malicious output manipulation or other terminal-dependent effects.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-150"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73035.json"
}
References

Affected packages

Git / github.com/raineorshine/npm-check-updates

Affected ranges

Type
GIT
Repo
https://github.com/raineorshine/npm-check-updates
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4448155d65695b47d8794ea828ffa3d30e5c5b3e
Fixed
b554b84848fc0b08a9d2b3d3db15e351387168cf
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "23.0.2"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.0.0
1.0.1
1.1.0
1.2.0
1.3.0
1.4.0
1.5.0
v10.*
v10.0.0
v10.1.0
v10.1.1
v10.2.0
v10.2.1
v10.2.2
v10.2.3
v10.2.4
v10.2.5
v10.3.0
v10.3.1
v11.*
v11.0.0
v11.0.1
v11.0.2
v11.1.0
v11.1.1
v11.1.10
v11.1.11
v11.1.2
v11.1.3
v11.1.4
v11.1.5
v11.1.6
v11.1.7
v11.1.8
v11.1.9
v11.2.0
v11.2.1
v11.2.2
v11.2.3
v11.3.0
v11.4.0
v11.4.1
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.2
v11.5.3
v11.5.4
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v11.6.0
v11.7.0
v11.7.1
v11.8.0
v11.8.1
v11.8.2
v11.8.3
v11.8.4
v11.8.5
v12.*
v12.0.0
v12.0.1
v12.0.2
v12.0.3
v12.0.5
v12.1.0
v12.2.0
v12.2.1
v12.3.0
v12.3.1
v12.4.0
v12.5.0
v12.5.1
v12.5.10
v12.5.11
v12.5.12
v12.5.2
v12.5.3
v12.5.4
v12.5.5
v12.5.6
v12.5.7
v12.5.8
v12.5.9
v13.*
v13.0.1
v13.0.2
v13.0.3
v13.0.4
v13.1.0
v13.1.1
v13.1.2
v13.1.3
v13.1.4
v13.1.5
v14.*
v14.0.0
v14.0.1
v14.1.0
v14.1.1
v15.*
v15.0.0
v15.0.1
v15.0.2
v15.0.3
v15.0.4
v15.0.5
v15.1.0
v15.2.0
v15.2.1
v15.2.2
v15.2.3
v15.2.4
v15.2.5
v15.2.6
v15.3.0
v15.3.1
v15.3.2
v15.3.3
v15.3.4
v16.*
v16.0.0
v16.0.1
v16.0.2
v16.0.3
v16.0.4
v16.0.5
v16.0.6
v16.1.0
v16.1.1
v16.1.2
v16.1.3
v16.10.0
v16.10.1
v16.10.11
v16.10.12
v16.10.13
v16.10.14
v16.10.15
v16.10.16
v16.10.17
v16.10.18
v16.10.19
v16.10.2
v16.10.3
v16.10.4
v16.10.5
v16.10.6
v16.10.7
v16.10.8
v16.11.0
v16.11.1
v16.11.2
v16.12.0
v16.12.1
v16.12.2
v16.12.3
v16.13.0
v16.13.1
v16.13.2
v16.13.3
v16.13.4
v16.14.0
v16.14.1
v16.14.10
v16.14.11
v16.14.12
v16.14.2
v16.14.3
v16.14.4
v16.14.5
v16.14.6
v16.14.7
v16.14.8
v16.14.9
v16.2.0
v16.2.0-0
v16.2.1
v16.3.0
v16.3.1
v16.3.10
v16.3.11
v16.3.12
v16.3.13
v16.3.14
v16.3.15
v16.3.16
v16.3.17
v16.3.18
v16.3.19
v16.3.2
v16.3.20
v16.3.21
v16.3.22
v16.3.23
v16.3.24
v16.3.25
v16.3.3
v16.3.4
v16.3.5
v16.3.6
v16.3.7
v16.3.8
v16.3.9
v16.4.0
v16.4.1
v16.4.2
v16.4.3
v16.5.0
v16.5.1
v16.5.2
v16.5.3
v16.5.4
v16.5.5
v16.5.6
v16.6.0
v16.6.1
v16.6.2
v16.6.3
v16.6.4
v16.6.5
v16.7.0
v16.7.1
v16.7.10
v16.7.11
v16.7.12
v16.7.13
v16.7.2
v16.7.3
v16.7.4
v16.7.5
v16.7.6
v16.7.7
v16.7.8
v16.7.9
v16.8.0
v16.8.1
v16.8.2
v16.9.0
v17.*
v17.0.0
v17.0.0-0
v17.0.0-1
v17.0.0-2
v17.0.0-3
v17.0.0-4
v17.0.0-5
v17.0.0-6
v17.0.0-7
v17.0.0-8
v17.0.1
v17.0.2
v17.0.3
v17.0.4
v17.0.5
v17.0.6
v17.1.0
v17.1.1
v17.1.10
v17.1.11
v17.1.12
v17.1.13
v17.1.14
v17.1.15
v17.1.16
v17.1.17
v17.1.18
v17.1.2
v17.1.3
v17.1.4
v17.1.5
v17.1.6
v17.1.7
v17.1.8
v17.1.9
v18.*
v18.0.0
v18.0.1
v18.0.2
v18.0.3
v18.1.0
v18.1.1
v18.2.0
v18.2.1
v18.3.0
v18.3.1
v19.*
v19.0.0
v19.1.0
v19.1.1
v19.1.2
v19.2.0
v19.2.1
v19.3.0
v19.3.1
v19.3.2
v19.4.0
v19.4.1
v19.5.0
v19.6.0
v19.6.1
v19.6.2
v19.6.3
v19.6.5
v19.6.6
v2.*
v2.0.0
v2.0.0-alpha.10
v2.0.0-alpha.11
v2.0.0-alpha.12
v2.0.0-alpha.13
v2.0.0-alpha.14
v2.0.0-alpha.15
v2.0.0-alpha.17
v2.0.0-alpha.7
v2.0.0-alpha.8
v2.0.0-alpha.9
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
v2.11.0
v2.11.1
v2.11.2
v2.11.3
v2.12.0
v2.12.1
v2.13.0
v2.14.0
v2.14.1
v2.14.2
v2.14.3
v2.15.0
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4
v2.4.0
v2.4.1
v2.4.2
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.5.5
v2.5.6
v2.5.7
v2.5.8
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.6.6
v2.6.7
v2.6.8
v2.7.0
v2.7.1
v2.7.2
v2.8.0
v2.8.1
v2.8.10
v2.8.2
v2.8.3
v2.8.4
v2.8.5
v2.8.6
v2.8.7
v2.8.8
v2.8.9
v2.9.0
v20.*
v20.0.0
v20.0.1
v20.0.2
v21.*
v21.0.0
v21.0.1
v21.0.2
v21.0.3
v22.*
v22.0.0
v22.0.1
v22.1.0
v22.1.1
v22.2.0
v22.2.1
v22.2.2
v22.2.3
v22.2.5
v22.2.6
v22.2.7
v22.2.8
v22.2.9
v23.*
v23.0.0
v23.0.1
v23.0.2
v3.*
v3.0.1
v3.0.10
v3.0.11
v3.0.12
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.0.7
v3.0.8
v3.0.9
v3.1.0
v3.1.1
v3.1.10
v3.1.11
v3.1.12
v3.1.13
v3.1.14
v3.1.15
v3.1.16
v3.1.17
v3.1.18
v3.1.19
v3.1.2
v3.1.20
v3.1.21
v3.1.22
v3.1.23
v3.1.24
v3.1.25
v3.1.26
v3.1.3
v3.1.4
v3.1.5
v3.1.6
v3.1.7
v3.1.8
v3.1.9
v3.2.0
v3.2.1
v3.2.2
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.1.0
v4.1.1
v4.1.2
v5.*
v5.0.0
v5.0.0-alpha.1
v5.0.0-alpha.2
v6.*
v6.0.0
v6.0.1
v7.*
v7.0.0
v7.0.1
v7.0.2
v7.0.3
v7.0.4
v7.1.0
v7.1.1
v8.*
v8.0.1
v8.0.2
v8.0.3
v8.0.4
v8.0.5
v8.1.0
v8.1.1
v9.*
v9.0.0
v9.0.1
v9.0.2
v9.0.3
v9.0.4
v9.1.0
v9.1.1
v9.1.2
v9.2.0
v9.2.1
v9.2.2
v9.2.3
v9.2.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73035.json"