raineorshine npm-check-updates up to 23.0.2 package.json injection

Summaryinfo

A vulnerability has been found in raineorshine npm-check-updates up to 23.0.2 and classified as critical. This affects an unknown function of the file package.json. This manipulation causes injection. This vulnerability is handled as CVE-2026-73035. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical was found in raineorshine npm-check-updates up to 23.0.2. Affected by this vulnerability is an unknown part of the file package.json. The manipulation with an unknown input leads to a injection vulnerability. The CWE definition for the vulnerability is CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --format homepage or --format repo option, unfiltered escape sequences are written directly to the terminal, enabling malicious output manipulation or other terminal-dependent effects.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-73035 since 08/10/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1055 for this issue.

By approaching the search of inurl:package.json it is possible to find vulnerable targets with Google Hacking.

Applying the patch b554b84848fc0b08a9d2b3d3db15e351387168cf is able to eliminate this problem.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Software Library

Vendor

• raineorshine

Name

• npm-check-updates

Version

• 23.0.0
• 23.0.1
• 23.0.2

Website

• Product: https://github.com/raineorshine/npm-check-updates/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion