CVE-2026-82584

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-82584
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82584.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-82584
Aliases
Published
2026-09-07T22:54:48Z
Modified
2026-09-09T03:47:17Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata
Details

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt.

mix igniter.install prints a confirmation panel (an anti-typosquatting safeguard) listing a package's hex metadata before adding it. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields (meta.description, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency.

This issue affects igniter: from 0.8.1 before 0.8.4.

Database specific 
{
    "cna_assigner": "EEF",
    "cwe_ids": [
        "CWE-150"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82584.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "d26d9b3a8348661813617606076315075d32663b"
                },
                {
                    "fixed": "d492b1aa33f8fb0dacc0afa41b703fb922d42816"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/ash-project/igniter

Affected ranges

Type
GIT
Repo
https://github.com/ash-project/igniter
Events
Introduced
3ea1fb0e140a943756326f02d5fc8abf7e959932
Fixed
c6d2b7f1d37ecb6de1a6be8ccb71bbc5cba6cb7a
Fixed
d492b1aa33f8fb0dacc0afa41b703fb922d42816
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.8.1"
        },
        {
            "fixed": "0.8.4"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.8.1
v0.8.2
v0.8.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82584.json"