CVE-2026-73035 in npm-check-updates
Summary
by MITRE • 08/11/2026
npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --format homepage or --format repo option, unfiltered escape sequences are written directly to the terminal, enabling malicious output manipulation or other terminal-dependent effects.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability exists within npm-check-updates version 23.0.2 and earlier, where the tool fails to properly sanitize user-provided data when displaying dependency information through specific formatting options. The issue stems from the tool's handling of package.json fields that contain homepage or repository URLs, which can include terminal escape sequences that manipulate the display output. When developers use the --format homepage or --format repo command-line options, the application directly outputs these unfiltered URL values to the terminal without proper sanitization, creating a potential injection vector for malicious terminal control characters.
The technical flaw manifests in the application's insufficient input validation and output encoding mechanisms. The vulnerability allows attackers to embed ANSI escape codes or other terminal control sequences within package.json metadata fields, which are then executed when displayed by npm-check-updates. This represents a classic terminal escape sequence injection vulnerability that can be categorized under CWE-1573, which specifically addresses improper handling of escape sequences in terminal applications. The flaw is particularly concerning because it leverages legitimate application functionality to deliver malicious payloads, making it difficult to detect through traditional security scanning methods.
The operational impact of this vulnerability extends beyond simple display manipulation, as attackers could potentially exploit this weakness to create misleading output that obscures or manipulates information presented to developers. Attackers might use this technique to hide malicious package versions, manipulate the perceived security status of dependencies, or even create phishing-like interfaces within terminal output. The vulnerability affects any developer environment where npm-check-updates is used with the vulnerable formatting options, potentially compromising security audits and dependency management workflows. This type of attack aligns with ATT&CK technique T1059.007 for command and scripting interpreter - PowerShell, as it involves manipulating terminal output to achieve malicious effects.
Mitigation strategies should focus on implementing proper input sanitization and output encoding before displaying any user-provided content in terminal environments. The fix requires that npm-check-updates properly escape or filter terminal control characters from package metadata fields before rendering them to stdout. Developers should avoid using the vulnerable --format options until the patch is applied, and organizations should ensure they are running version 23.0.3 or later where this vulnerability has been addressed through commit b554b84. Additionally, security teams should monitor for potential exploitation attempts in their dependency management processes and consider implementing automated checks to validate package metadata integrity as part of their software supply chain security measures.