CVE-2026-49864 in wetty
Summary
by MITRE • 08/13/2026
wetty provides terminal access in browser over http/https. Prior to version 3.0.4, the wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string (`escapeMarkup: false`). Any output the victim renders - a `cat`'d file, a tailed log, an SSH MOTD, a `curl` response - that contains `\x1b[5i...:...\x1b[4i` runs script in the wetty origin and types attacker-chosen keystrokes into the victim's SSH session. Version 3.0.4 fixes the issue.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The wetty terminal access system presents a critical server-side request forgery vulnerability that enables remote code execution through carefully crafted terminal output sequences. This vulnerability affects versions prior to 3.0.4 and stems from improper input validation within the file download functionality. The flaw occurs when the wetty client processes base64-encoded filenames from file-download escape sequences, directly interpolating them into Toastify HTML strings without proper sanitization. This represents a classic cross-site scripting vulnerability that manifests in a unique terminal context where attackers can manipulate both the display and input behavior of connected sessions.
The technical exploitation leverages the specific escape sequence pattern \x1b[5i...:...\x1b[4i which serves as a file download indicator in terminal environments. When victim terminals render output containing this sequence, the vulnerable wetty client interprets the embedded base64 data and injects it directly into HTML markup without sanitization. This injection point allows attackers to execute arbitrary JavaScript code within the wetty origin context, effectively enabling remote code execution against connected terminal sessions. The vulnerability demonstrates a dangerous combination of improper input handling and HTML injection that bypasses typical security boundaries between client-side rendering and user interaction.
The operational impact of this vulnerability extends beyond simple command execution to full session manipulation capabilities. Attackers can not only execute arbitrary commands on the victim's system but also inject keystrokes into active SSH sessions, potentially automating malicious actions or harvesting credentials. This capability transforms a simple terminal access tool into a sophisticated attack vector that can compromise entire terminal environments. The vulnerability affects any user who connects through wetty to systems containing output that matches the targeted escape sequence pattern, including log files, system messages, and command responses.
Security mitigations for this vulnerability require proper input sanitization and context-appropriate escaping of all user-supplied data before HTML rendering. The fix implemented in version 3.0.4 properly escapes base64 filename data before insertion into Toastify HTML strings, preventing script injection through the escape sequence mechanism. Organizations should also implement additional security measures including network segmentation for terminal access systems, monitoring for suspicious escape sequence patterns in terminal output, and regular security updates to prevent exploitation of similar vulnerabilities. This vulnerability aligns with CWE-79 (Cross-site Scripting) and represents a variant of the broader category of injection flaws that can be exploited to gain unauthorized access to terminal sessions. The ATT&CK framework categorizes this as a privilege escalation technique through session manipulation, where attackers leverage terminal access tools to extend their control over connected systems.