Improper Neutralization of Escape, Meta, or Control Sequences in pnpm - #VU153398
Published: October 6, 2026
Vulnerability identifier: #VU153398
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-150
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to inject terminal control characters into license table output.
The vulnerability exists due to improper neutralization of terminal control characters in pnpm licenses table rendering when displaying package metadata. A remote attacker can supply package metadata containing terminal control characters to inject terminal control characters into license table output.
Affected software
pnpm
Remediation
Install security update from vendor's website.
pnpm - addressed in versions 11.28.5, 12.10.0