CVE-2026-82584 in igniter
Summary
by MITRE • 09/08/2026
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt.
mix igniter.install prints a confirmation panel (an anti-typosquatting safeguard) listing a package's hex metadata before adding it. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields (meta.description, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency.
This issue affects igniter: from 0.8.1 before 0.8.4.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified as Improper Neutralization of Escape, Meta, or Control Sequences within the ash-project igniter tool represents a significant security risk in software supply chain management contexts. This flaw specifically impacts versions from 0.8.1 up to but not including 0.8.4. The core issue lies in how the mix igniter.install command handles user interaction during package installation, particularly regarding its anti-typosquatting safeguard mechanism. When a developer initiates an install process for a new dependency, the tool is designed to display a confirmation panel that presents critical metadata about the package, such as its hex identifier, description, owner username, and version requirements. This interface serves as a crucial checkpoint allowing developers to verify they are installing the intended library rather than a malicious alternative or typosquatted variant.
The technical root cause of this vulnerability is found in the implementation of the panel builder within Igniter.Project.Deps. When rendering this confirmation prompt, the system processes publisher-controlled fields including meta.description, owner usernames, requirement names, and version strings. However, the sanitization logic applied to these inputs is insufficient. The code only strips newline characters from the input data before writing it to the terminal output stream. It fails to neutralize other control sequences, specifically ANSI escape codes that are commonly used in modern terminals for cursor movement, line erasure, carriage returns, and text styling. Because the terminal emulator interprets these raw escape sequences as commands rather than literal text characters, an attacker can exploit this behavior by embedding specific byte sequences within any of the metadata fields associated with a package.
This lack of proper neutralization allows a malicious or typosquatted package publisher to forge the visual representation of the confirmation panel. By injecting carefully crafted ANSI escape sequences into the description or owner name fields, an attacker can manipulate the terminal display state during the rendering process. For instance, using carriage returns and cursor movement codes, the attacker can overwrite previously printed text on the screen. This capability enables them to hide the true package metadata, such as a suspicious hex identifier or unknown author, while simultaneously displaying fabricated information that appears legitimate. The forged output might show trusted-looking author names, inflated download counts, or benign descriptions that do not match the actual contents of the package being installed.
The operational impact of this vulnerability is severe because it directly undermines the developer's ability to make informed security decisions during dependency resolution. Developers rely on these confirmation prompts as a primary defense against typosquatting attacks and malicious supply chain injections. When an attacker successfully forges the panel, they deceive the developer into approving the installation of a compromised package under false pretenses. Once installed, this malicious dependency can introduce backdoors, data exfiltration mechanisms, or other harmful behaviors into the application codebase. This type of attack is particularly dangerous because it exploits trust in the development tooling itself, bypassing automated static analysis by tricking the human operator directly at the point of integration.
From a classification perspective, this vulnerability aligns with CWE-116, which covers Improper Neutralization of Escape, Meta, or Control Sequences in CPE and other Product Identification fields. It also relates to CWE-79 if one considers the potential for subsequent script injection via terminal rendering artifacts, though the primary vector is control sequence manipulation rather than HTML-based XSS. In terms of adversary tactics, this technique maps to ATT&CK T1059 Command and Scripting Interpreter through the abuse of shell features, specifically leveraging ANSI escape codes which are interpreted by the command-line interface. It also falls under supply chain compromise strategies where trust in package registries is subverted via social engineering facilitated by technical manipulation of user interfaces.
To mitigate this vulnerability, developers using affected versions must upgrade to igniter version 0.8.4 or later, where the panel builder has been patched to properly sanitize all control characters and escape sequences before rendering them to the terminal output. Until an upgrade is possible, manual verification of package metadata via external sources such as the official Hex registry website is recommended rather than relying solely on the in-terminal confirmation prompt. Security teams should also enforce strict policies regarding dependency approval processes, ensuring that any discrepancies between displayed information and known good data trigger immediate investigation. Regular auditing of third-party packages for unusual control character usage can further reduce exposure to this class of terminal-based injection attacks.