CVE-2026-50642

{
  "id": "CVE-2026-50642",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-29T11:16:49.617",
  "lastModified": "2026-10-23T23:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences while allowing other control characters, including carriage return (\\r) and escape sequences (e.g., OSC, CSI), to pass through unsanitized.\n\nAn attacker can embed malicious control sequences in filenames, diff metadata, or file content that are rendered directly in the terminal during diff viewing. This can lead to output manipulation, including filename spoofing, terminal screen clearing, and clipboard injection via supported escape sequences.\n\nSuccessful exploitation may mislead users during code review, alter terminal state, or result in unintended command execution through clipboard hijacking.\n\nThis issue has been fixed in the commit 9c81294"
    },
    {
      "lang": "es",
      "value": "diff?so?fancy no sanitiza correctamente las secuencias de control de terminal no SGR antes de mostrar los datos diff. La aplicación solo elimina las secuencias ANSI SGR mientras permite que otros caracteres de control, incluyendo el retorno de carro (\\r) y las secuencias de escape (p. ej., OSC, CSI), pasen sin sanitizar.\n\nUn atacante puede incrustar secuencias de control maliciosas en nombres de archivo, metadatos diff o contenido de archivo que se renderizan directamente en el terminal durante la visualización del diff. Esto puede llevar a la manipulación de la salida, incluyendo la suplantación de nombres de archivo, el borrado de la pantalla del terminal y la inyección en el portapapeles a través de secuencias de escape soportadas.\n\nLa explotación exitosa puede inducir a error a los usuarios durante la revisión de código, alterar el estado del terminal o resultar en la ejecución de comandos no deseados mediante el secuestro del portapapeles.\n\nEste problema ha sido corregido en el commit 9c81294"
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "so-fancy",
          "product": "diff-so-fancy",
          "defaultStatus": "unaffected",
          "repo": "https://github.com/so-fancy/diff-so-fancy",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.4.10",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "PASSIVE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "LOW",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-29T12:13:35.752261Z",
          "id": "CVE-2026-50642",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cert.pl/posts/2026/07/CVE-2026-41874/",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/so-fancy/diff-so-fancy",
      "source": "[email protected]"
    }
  ]
}