CVE-2026-90773 in procs
Summary
by MITRE • 09/13/2026
procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute processes with malicious ANSI or OSC escape sequences in their command line arguments, which are written unmodified to other users' terminals for interpretation by terminal emulators.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/13/2026
The vulnerability identified in procs versions through 0.14.12 represents a significant security flaw rooted in the failure to properly sanitize input data before rendering it within a terminal interface. Specifically, the application does not escape or filter ANSI and OSC (Operating System Command) escape sequences found within process command lines prior to displaying them in the Command column of its user interface. This oversight allows any local attacker who can execute processes with specially crafted arguments containing these control characters to inject malicious formatting instructions directly into the output stream viewed by other users on the same system. The core technical flaw lies in the assumption that raw text from process command lines is safe for direct display, ignoring the fact that modern terminal emulators interpret specific byte sequences as commands rather than literal data.
From a technical perspective, ANSI escape codes are widely used to control cursor movement, color changes, and other visual attributes within terminals. However, certain OSC sequences can trigger more dangerous behaviors depending on the terminal emulator being used. For instance, some implementations allow OSC sequences to modify window titles, set clipboard contents, or even execute arbitrary shell commands if configured with specific security policies that permit such interactions. By failing to neutralize these sequences, procs effectively acts as a vector for injecting executable code into the context of another user's terminal session. This is particularly concerning because command lines are often visible in system monitoring tools and logs, making them an attractive target for attackers seeking to exploit trust relationships within multi-user environments or shared workstations.
The operational impact of this vulnerability extends beyond simple visual spoofing. An attacker with local access can leverage this flaw to perform terminal-based attacks such as clickjacking within the terminal environment, tricking users into interacting with malicious UI elements that appear legitimate due to injected formatting. More severely, if the target user's terminal emulator supports OSC command execution for features like window title setting or clipboard manipulation, an attacker could potentially exfiltrate sensitive information by encoding it in escape sequences that update the window title or copy data to the system clipboard when viewed by a victim. This creates a cross-user contamination risk where one compromised account can affect others sharing the same physical machine or virtual environment without requiring elevated privileges for execution, only local process creation rights which are typically granted to all authenticated users.
This vulnerability aligns with CWE-79, specifically Improper Neutralization of Input During Web Page Generation in some contexts, but more accurately maps to CWE-16: Configuration and CWE-436: Interpretation Conflict when considering how different terminal emulators might interpret the same escape sequence differently or dangerously. In terms of the MITRE ATT&CK framework, this behavior facilitates Initial Access via Local Exploitation and can be categorized under Tactic TA0005 (Defense Evasion) if used to hide malicious activity through visual obfuscation, or more critically under Execution techniques that leverage terminal features for command execution depending on the specific escape sequence exploited. It also touches upon Social Engineering principles by manipulating the perceived state of a user's interface.
Mitigation strategies must focus on strict input validation and output encoding at the application level. The primary fix involves implementing robust sanitization routines within procs to detect and strip or encode any ANSI, OSC, or other control sequences present in process command lines before they are passed to the terminal rendering engine. Developers should treat all data originating from external sources, including system processes, as untrusted input requiring rigorous filtering. Additionally, users can mitigate risk by ensuring their terminal emulators are configured with security settings that disable automatic execution of OSC commands or restrict window title modifications to trusted applications only. Upgrading to a patched version of procs where this sanitization logic has been implemented is the most effective immediate remedy for organizations relying on this tool for system monitoring and process inspection tasks.