CVE-2026-50642

medium Red Hat
CVSS v3 Base Score
4.4
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Attack Characteristics
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Confidentiality
None
Integrity
Low
Availability
Low
Published: July 29, 2026 (39 days ago)
Last Modified: July 29, 2026
Vendor: Red Hat
Source: REDHAT

Description

A flaw was found in diff-so-fancy. The application does not properly sanitize non-SGR (Select Graphic Rendition) terminal control sequences, allowing other control characters and escape sequences to pass through. An attacker can embed malicious control sequences in filenames, diff metadata, or file content, which are then rendered directly in the terminal when a user views the diff. This can lead to output manipulation, including filename spoofing and terminal screen clearing, and may result in unintended command execution through clipboard hijacking, potentially misleading users during code review.

CWE

CWE-94

References

🔗 bugzilla.redhat.com 🔗 www.cve.org 🔗 nvd.nist.gov 🔗 cert.pl 🔗 github.com