CVE-2026-100866 onefetch through 2.28.1 Terminal Escape Sequence Injection
Attackers can inject terminal escape sequences via repository metadata to manipulate victim terminal output and window titles when running onefetch.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-100866?
CVE-2026-100866 is a medium-severity vulnerability in o2sh onefetch, published on 27 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest version and name fields to manipulate terminal output, rewrite window titles, hide text, or trigger emulator-specific behavior when victims run onefetch.
Weakness: CWE-150
Which versions are affected by CVE-2026-100866?
Linux distribution packages (1)
onefetch openSUSE:Tumbleweed | All versions | 3.0.0-1.1 |
How do I fix CVE-2026-100866?
Upgrade to a fixed version.
Is CVE-2026-100866 being exploited?
There is no known exploitation of CVE-2026-100866 in the wild and no public exploit code.
Sources
Also known as GHSA-fp7q-m5xh-3ggj, openSUSE-SU-2026:12085-1.