Vulnerability · Published Sep 27, 2026 · Assigned by VulnCheck

CVE-2026-100866onefetch through 2.28.1 Terminal Escape Sequence Injection

Low 3.3

In plain English

A low-severity security flaw in onefetch from o2sh. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low

Exploit odds (30 days)0.1%top 97.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest version and name fields to manipulate terminal output, rewrite window titles, hide text, or trigger emulator-specific behavior when victims run onefetch.

Affected products (as reported)

Vendor	Product	Versions
o2sh	onefetch	0 – through 2.28.1

Weakness: CWE-150 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

References

GitHub Issue #1828 issue-tracking
https://github.com/o2sh/onefetch/blob/9beb80329cf2e5bd784270f668139f0bafb48e2b/src/info/utils/info_field.rs#L43-L55 technical-description
https://github.com/o2sh/onefetch/blob/9beb80329cf2e5bd784270f668139f0bafb48e2b/src/info/version.rs#L33-L35 technical-description
https://github.com/o2sh/onefetch product
VulnCheck Advisory: onefetch through 2.28.1 Terminal Escape Sequence Injection third-party-advisory