{"vulnerability": "GHSA-8QX3-8GM5-9CJ2", "sightings": [{"uuid": "1b2c7025-53a1-4e28-aa6c-38d44a0ca751", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-8QX3-8GM5-9CJ2", "type": "seen", "source": "https://gist.github.com/alon710/f2a12bfbfca0585cae931c87678788d3", "content": "# GHSA-8QX3-8GM5-9CJ2: GHSA-8QX3-8GM5-9CJ2: Terminal Escape-Sequence Injection in pickem\n\n> **CVSS Score:** 7.8\n> **Published:** 2026-08-25\n> **Full Report:** https://cvereports.com/reports/GHSA-8QX3-8GM5-9CJ2\n\n## Summary\nThe npm package 'pickem' is vulnerable to a terminal escape-sequence injection (CWE-150). Unsanitized terminal outputs allow attackers to execute arbitrary shell commands via clipboard hijacking (OSC 52) or manipulate terminal displays through Control Sequence Introducers (CSI).\n\n## TL;DR\nUnsanitized rendering of user input in the 'pickem' library allows attackers to inject terminal escape sequences, potentially leading to remote code execution through clipboard hijacking (OSC 52).\n\n## Technical Details\n\n- **CWE ID**: CWE-150\n- **Attack Vector**: Local / Network-Adjacent (via external inputs like branch names or PR titles)\n- **CVSS v3.1 Score**: 7.8\n- **EPSS Score**: N/A\n- **Exploit Status**: Proof of Concept (PoC) available in official unit tests\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- CLI tools using the pickem library\n- Node.js CLI environments with user-supplied prompts\n\n## Mitigation\n\n- Upgrade the pickem package to version 1.0.7 or later\n- Filter user-controllable input strings for non-printable control characters\n- Disable OSC 52 clipboard write features in terminal emulator configurations if not strictly required\n\n**Remediation Steps:**\n1. Run 'npm install pickem@latest' to update the local package dependency\n2. Audit CLI applications to verify that rendering inputs are passed through the sanitizeDisplay utility\n3. Employ static code analysis to search for output components that write unsanitized variables to stdout\n\n## References\n\n- [GitHub Advisory GHSA-8QX3-8GM5-9CJ2](https://github.com/advisories/GHSA-8QX3-8GM5-9CJ2)\n- [GitHub Repository for pickem-oss](https://github.com/calebogden/pickem-oss)\n- [pickem-oss v1.0.7 Release Details](https://github.com/calebogden/pickem-oss/releases/tag/v1.0.7)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-8QX3-8GM5-9CJ2) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-25T16:32:03.045292Z"}]}