Отправить #1040563: https://github.com/nushell/ nushell 0.114.1 Improper Encoding or Escaping of Output

to json/csv/tsv/text/nuon/md output commands don't strip terminal escape sequences, and to json's serializer doesn't escape control characters per RFC 8259

Affected versions: nu <= 0.114.1

Description
nushell's data-conversion commands write a value's string content directly to stdout. `to yaml`, `to toml`, and `to xml` correctly escape control characters because doing so is mandatory for correctly serializing those formats, and the libraries nushell uses for them already handle it. Six other commands do not:

- `crates/nu-json/src/ser.rs`'s `escape_bytes` (`to json`) only handles the seven characters with dedicated JSON shorthand escapes (`"`, `\`, backspace, form feed, `\n`, `\r`, `\t`); every other control character, including ESC, falls through unescaped. This is also an RFC 8259 conformance defect independent of terminal safety: the JSON produced can contain a literal, unescaped control character inside a string, which the spec forbids.
- `crates/nu-command/src/formats/to/delimited.rs`'s `to_string_tagged_value` (shared by `to csv` and `to tsv`) and `crates/nu-command/src/formats/to/text.rs`'s `local_into_string` (`to text`) both pass a `Value::String`'s content through unchanged.
- `crates/nu-command/src/formats/to/md.rs`'s `escape_markdown_characters` (`to md`) only escapes markdown-syntax characters, not control characters.
- `crates/nu-utils/src/quoting.rs`'s `escape_quote_string` (`to nuon`, and several unrelated internal callers for re-serializing values or command-line syntax) only escapes `"` and `\`.

## Proof of Concept

(available upon request)

## Impact

An attacker who can get a victim to process data containing a string value with an embedded escape sequence (a file via `open`, an API response via `http get`, any other data source) using `to json`, `to csv`, `to tsv`, `to text`, `to nuon`, or `to md` can inject terminal escape sequences into the victim's terminal. Separately, anything relying on `to json`'s output being valid JSON (piping to another program, writing a config file, an API request body) can receive non-conformant output when a string value contains a control character.

## Patches / Fix

A fix has been written and validated (a PR will follow this advisory). It touches 5 locations across 4 crates: `nu-json`'s `escape_bytes` (extended to escape any byte below `0x20` via the generic `\u00XX` form), `nu-command`'s `to_string_tagged_value` (csv/tsv) and `local_into_string` (text) and `escape_markdown_characters` (md), and `nu-utils`'s `escape_quote_string` (nuon, escaping control characters other than newline/tab to minimize impact on that function's other callers). Re-tested against all six affected formats after the fix: the injected escape bytes are fully removed in every case, with `to json` and `to nuon` now correctly producing standard escape sequences instead of raw bytes. The project's test suite passes for every affected crate (one unrelated, pre-existing failure in `nu-utils::split_read::tests::empty_delimiter` was confirmed via `git stash` to also occur before this fix).

## Workarounds

None identified; avoid piping `to json`/`to csv`/`to tsv`/`to text`/`to nuon`/`to md` output from untrusted data directly to an interactive terminal until patched.

• Источник: ⚠️ https://github.com/nushell/nushell/issues/19197
• Пользователь: carfeii (UID 97470)
• Представление: 17.10.2026 16:41 (23 дни назад)
• Модерация: 09.11.2026 16:31 (23 days later)
• Статус: принято
• Запись VulDB: 433164 [nushell до 0.116.1 Data Conversion ser.rs escape_bytes]
• Баллы: 20