Vulnerability-Lookup

CVE-2026-82584 (GCVE-0-2026-82584)

Vulnerability from cvelistv5 – Published: 2026-09-07 22:54 – Updated: 2026-09-08 14:44

Title

Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata

Summary

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel (an anti-typosquatting safeguard) listing a package's hex metadata before adding it. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields (meta.description, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency. This issue affects igniter: from 0.8.1 before 0.8.4.

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 14:44 UTC

CWE

CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences

Assigner

EEF mitre root

References

4 references

URL	Tags
https://github.com/ash-project/igniter/security/a…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-82584.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-82584	related
https://github.com/ash-project/igniter/commit/d49…	patch

Impacted products

2 products

Vendor	Product	Version	CPE status
ash-project	igniter	Affected: 0.8.1 , < 0.8.4 (semver) cpe:2.3:a:ash-project:igniter::::::::
ash-project	igniter	Affected: d26d9b3a8348661813617606076315075d32663b , < d492b1aa33f8fb0dacc0afa41b703fb922d42816 (git) cpe:2.3:a:ash-project:igniter::::::::

Credits

Peter Ullrich Peter Ullrich Zach Daniel / Ash Project Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82584",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T14:44:50.539017Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T14:44:59.110Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ash-project:igniter:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Igniter.Project.Deps\u0027"
          ],
          "packageName": "igniter",
          "packageURL": "pkg:hex/igniter",
          "product": "igniter",
          "programFiles": [
            "lib/igniter/project/deps.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Igniter.Project.Deps\u0027:determine_dep_type_and_version!/2"
            }
          ],
          "repo": "https://github.com/ash-project/igniter",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "0.8.4",
              "status": "affected",
              "version": "0.8.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ash-project:igniter:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Igniter.Project.Deps\u0027"
          ],
          "packageName": "ash-project/igniter",
          "packageURL": "pkg:github/ash-project/igniter",
          "product": "igniter",
          "programFiles": [
            "lib/igniter/project/deps.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Igniter.Project.Deps\u0027:determine_dep_type_and_version!/2"
            }
          ],
          "repo": "https://github.com/ash-project/igniter",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "d492b1aa33f8fb0dacc0afa41b703fb922d42816",
              "status": "affected",
              "version": "d26d9b3a8348661813617606076315075d32663b",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eReachable only when a developer runs \u003ccode\u003emix igniter.install\u003c/code\u003e against an untrusted or misspelled package name in a terminal emulator that interprets ANSI escape sequences.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Reachable only when a developer runs `mix igniter.install` against an untrusted or misspelled package name in a terminal emulator that interprets ANSI escape sequences."
            }
          ],
          "value": "Reachable only when a developer runs mix igniter.install against an untrusted or misspelled package name in a terminal emulator that interprets ANSI escape sequences."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ash-project:igniter:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.8.4",
                  "versionStartIncluding": "0.8.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Zach Daniel / Ash Project"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the \u003ccode\u003emix igniter.install\u003c/code\u003e confirmation prompt.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003emix igniter.install\u003c/code\u003e prints a confirmation panel (an anti-typosquatting safeguard) listing a package\u0027s hex metadata before adding it. The panel builder in \u003ccode\u003eIgniter.Project.Deps\u003c/code\u003e wrote publisher-controlled fields (\u003ccode\u003emeta.description\u003c/code\u003e, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency.\u003c/p\u003e\n\u003cp\u003eThis issue affects igniter: from 0.8.1 before 0.8.4.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the `mix igniter.install` confirmation prompt.\n\n`mix igniter.install` prints a confirmation panel (an anti-typosquatting safeguard) listing a package\u0027s hex metadata before adding it. The panel builder in `Igniter.Project.Deps` wrote publisher-controlled fields (`meta.description`, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency.\n\nThis issue affects igniter: from 0.8.1 before 0.8.4."
            }
          ],
          "value": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt.\n\nmix igniter.install prints a confirmation panel (an anti-typosquatting safeguard) listing a package\u0027s hex metadata before adding it. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields (meta.description, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency.\n\nThis issue affects igniter: from 0.8.1 before 0.8.4."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-93",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-93 Log Injection-Tampering-Forging"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T22:54:48.222Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/ash-project/igniter/security/advisories/GHSA-cj7w-j579-gc42"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-82584.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-82584"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ash-project/igniter/commit/d492b1aa33f8fb0dacc0afa41b703fb922d42816"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-82584",
    "datePublished": "2026-09-07T22:54:48.222Z",
    "dateReserved": "2026-09-07T21:00:01.988Z",
    "dateUpdated": "2026-09-08T14:44:59.110Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-82584",
      "date": "2026-09-13",
      "epss": "0.00304",
      "percentile": "0.22927"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-82584\",\"sourceIdentifier\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"published\":\"2026-09-07T23:16:51.933\",\"lastModified\":\"2026-09-08T15:18:49.697\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt.\\n\\nmix igniter.install prints a confirmation panel (an anti-typosquatting safeguard) listing a package\u0027s hex metadata before adding it. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields (meta.description, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency.\\n\\nThis issue affects igniter: from 0.8.1 before 0.8.4.\"}],\"affected\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"affectedData\":[{\"vendor\":\"ash-project\",\"product\":\"igniter\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.hex.pm\",\"packageName\":\"igniter\",\"cpes\":[\"cpe:2.3:a:ash-project:igniter:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.Igniter.Project.Deps\u0027\"],\"programFiles\":[\"lib/igniter/project/deps.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.Igniter.Project.Deps\u0027:determine_dep_type_and_version!/2\"}],\"repo\":\"https://github.com/ash-project/igniter\",\"packageURL\":\"pkg:hex/igniter\",\"versions\":[{\"version\":\"0.8.1\",\"lessThan\":\"0.8.4\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"ash-project\",\"product\":\"igniter\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com\",\"packageName\":\"ash-project/igniter\",\"cpes\":[\"cpe:2.3:a:ash-project:igniter:*:*:*:*:*:*:*:*\"],\"modules\":[\"\u0027Elixir.Igniter.Project.Deps\u0027\"],\"programFiles\":[\"lib/igniter/project/deps.ex\"],\"programRoutines\":[{\"name\":\"\u0027Elixir.Igniter.Project.Deps\u0027:determine_dep_type_and_version!/2\"}],\"repo\":\"https://github.com/ash-project/igniter\",\"packageURL\":\"pkg:github/ash-project/igniter\",\"versions\":[{\"version\":\"d26d9b3a8348661813617606076315075d32663b\",\"lessThan\":\"d492b1aa33f8fb0dacc0afa41b703fb922d42816\",\"versionType\":\"git\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":2.3,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-08T14:44:50.539017Z\",\"id\":\"CVE-2026-82584\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-150\"}]}],\"references\":[{\"url\":\"https://cna.erlef.org/cves/CVE-2026-82584.html\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ash-project/igniter/commit/d492b1aa33f8fb0dacc0afa41b703fb922d42816\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://github.com/ash-project/igniter/security/advisories/GHSA-cj7w-j579-gc42\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"},{\"url\":\"https://osv.dev/vulnerability/EEF-CVE-2026-82584\",\"source\":\"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-82584\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-08T14:44:50.539017Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-08T14:44:55.299Z\"}}], \"cna\": {\"title\": \"Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Zach Daniel / Ash Project\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Jonatan M\\u00e4nnchen / EEF\"}], \"impacts\": [{\"capecId\": \"CAPEC-93\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-93 Log Injection-Tampering-Forging\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 2.3, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ash-project:igniter:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/ash-project/igniter\", \"vendor\": \"ash-project\", \"modules\": [\"\u0027Elixir.Igniter.Project.Deps\u0027\"], \"product\": \"igniter\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.8.1\", \"lessThan\": \"0.8.4\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:hex/igniter\", \"packageName\": \"igniter\", \"programFiles\": [\"lib/igniter/project/deps.ex\"], \"collectionURL\": \"https://repo.hex.pm\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.Igniter.Project.Deps\u0027:determine_dep_type_and_version!/2\"}]}, {\"cpes\": [\"cpe:2.3:a:ash-project:igniter:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/ash-project/igniter\", \"vendor\": \"ash-project\", \"modules\": [\"\u0027Elixir.Igniter.Project.Deps\u0027\"], \"product\": \"igniter\", \"versions\": [{\"status\": \"affected\", \"version\": \"d26d9b3a8348661813617606076315075d32663b\", \"lessThan\": \"d492b1aa33f8fb0dacc0afa41b703fb922d42816\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:github/ash-project/igniter\", \"packageName\": \"ash-project/igniter\", \"programFiles\": [\"lib/igniter/project/deps.ex\"], \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.Igniter.Project.Deps\u0027:determine_dep_type_and_version!/2\"}]}], \"references\": [{\"url\": \"https://github.com/ash-project/igniter/security/advisories/GHSA-cj7w-j579-gc42\", \"tags\": [\"vendor-advisory\", \"related\"]}, {\"url\": \"https://cna.erlef.org/cves/CVE-2026-82584.html\", \"tags\": [\"related\"]}, {\"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-82584\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/ash-project/igniter/commit/d492b1aa33f8fb0dacc0afa41b703fb922d42816\", \"tags\": [\"patch\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt.\\n\\nmix igniter.install prints a confirmation panel (an anti-typosquatting safeguard) listing a package\u0027s hex metadata before adding it. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields (meta.description, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency.\\n\\nThis issue affects igniter: from 0.8.1 before 0.8.4.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eImproper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the \u003ccode\u003emix igniter.install\u003c/code\u003e confirmation prompt.\u003c/p\u003e\\n\u003cp\u003e\u003ccode\u003emix igniter.install\u003c/code\u003e prints a confirmation panel (an anti-typosquatting safeguard) listing a package\u0027s hex metadata before adding it. The panel builder in \u003ccode\u003eIgniter.Project.Deps\u003c/code\u003e wrote publisher-controlled fields (\u003ccode\u003emeta.description\u003c/code\u003e, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency.\u003c/p\u003e\\n\u003cp\u003eThis issue affects igniter: from 0.8.1 before 0.8.4.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the `mix igniter.install` confirmation prompt.\\n\\n`mix igniter.install` prints a confirmation panel (an anti-typosquatting safeguard) listing a package\u0027s hex metadata before adding it. The panel builder in `Igniter.Project.Deps` wrote publisher-controlled fields (`meta.description`, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency.\\n\\nThis issue affects igniter: from 0.8.1 before 0.8.4.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-150\", \"description\": \"CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"Reachable only when a developer runs mix igniter.install against an untrusted or misspelled package name in a terminal emulator that interprets ANSI escape sequences.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eReachable only when a developer runs \u003ccode\u003emix igniter.install\u003c/code\u003e against an untrusted or misspelled package name in a terminal emulator that interprets ANSI escape sequences.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"Reachable only when a developer runs `mix igniter.install` against an untrusted or misspelled package name in a terminal emulator that interprets ANSI escape sequences.\", \"base64\": false}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:ash-project:igniter:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"0.8.4\", \"versionStartIncluding\": \"0.8.1\"}], \"operator\": \"OR\"}], \"operator\": \"AND\"}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-09-07T22:54:48.222Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-82584\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-08T14:44:59.110Z\", \"dateReserved\": \"2026-09-07T21:00:01.988Z\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"datePublished\": \"2026-09-07T22:54:48.222Z\", \"assignerShortName\": \"EEF\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-82584

Vulnerability from fkie_nvd - Published: 2026-09-07 23:16 - Updated: 2026-09-08 15:18

Severity

2.3 (Low) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://cna.erlef.org/cves/CVE-2026-82584.html
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/ash-project/igniter/commit/d492b1aa33f8fb0dacc0afa41b703fb922d42816
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/ash-project/igniter/security/advisories/GHSA-cj7w-j579-gc42
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://osv.dev/vulnerability/EEF-CVE-2026-82584

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:ash-project:igniter:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Igniter.Project.Deps\u0027"
          ],
          "packageName": "igniter",
          "packageURL": "pkg:hex/igniter",
          "product": "igniter",
          "programFiles": [
            "lib/igniter/project/deps.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Igniter.Project.Deps\u0027:determine_dep_type_and_version!/2"
            }
          ],
          "repo": "https://github.com/ash-project/igniter",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "0.8.4",
              "status": "affected",
              "version": "0.8.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:ash-project:igniter:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Igniter.Project.Deps\u0027"
          ],
          "packageName": "ash-project/igniter",
          "packageURL": "pkg:github/ash-project/igniter",
          "product": "igniter",
          "programFiles": [
            "lib/igniter/project/deps.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Igniter.Project.Deps\u0027:determine_dep_type_and_version!/2"
            }
          ],
          "repo": "https://github.com/ash-project/igniter",
          "vendor": "ash-project",
          "versions": [
            {
              "lessThan": "d492b1aa33f8fb0dacc0afa41b703fb922d42816",
              "status": "affected",
              "version": "d26d9b3a8348661813617606076315075d32663b",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt.\n\nmix igniter.install prints a confirmation panel (an anti-typosquatting safeguard) listing a package\u0027s hex metadata before adding it. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields (meta.description, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency.\n\nThis issue affects igniter: from 0.8.1 before 0.8.4."
    }
  ],
  "id": "CVE-2026-82584",
  "lastModified": "2026-09-08T15:18:49.697",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 2.3,
          "baseSeverity": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-82584",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-08T14:44:50.539017Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-07T23:16:51.933",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://cna.erlef.org/cves/CVE-2026-82584.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/ash-project/igniter/commit/d492b1aa33f8fb0dacc0afa41b703fb922d42816"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/ash-project/igniter/security/advisories/GHSA-cj7w-j579-gc42"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-82584"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-150"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-82584 (GCVE-0-2026-82584)

FKIE_CVE-2026-82584

Tags

Sightings

Nomenclature