{"schema":"threatline.record/2","record":{"id":"CVE-2026-54162","aliases":["GHSA-x3g7-qrwc-f6c5","GO-2026-6270"],"summary":"Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUI","details":"Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row formatters pass Caddy access-log fields, particularly the request URI, through the `fitCellLeft` render helper without neutralizing terminal escape or control sequences. An unauthenticated remote client can place ANSI, OSC, or CSI control bytes in an ordinary HTTP request target. Caddy JSON-escapes those bytes, `ParseLogLine` decodes them back into raw controls, and the formatters concatenate them into `View()` output reaching `os.Stdout`. When the operator views the default `Logs` tab, the terminal interprets these sequences, allowing monitoring-dashboard spoofing, clipboard hijacking through `OSC 52`, and window-title spoofing through `OSC 0/2`. This works even with a loopback-only log listener because the input arrives through normal Caddy access logs. `Certificates` and `Routes` share secondary unneutralized render sinks. The `--json`, `--once`, and daemon `--expose` modes are unaffected because they do not render an interactive terminal. Consequences depend on the terminal emulator and usually require further operator action to escalate; this is not general-purpose remote code execution. This issue is fixed in version 1.4.2.","categories":["Libraries & packages"],"product":"ember","vendor":"alexandre-daubois","ecosystem":"Go","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-54162","source_modified_at":"2026-10-28T19:44:41.999Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"ember","vendor":"alexandre-daubois","versions":[{"version":"< 1.4.2","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-x3g7-qrwc-f6c5","source_modified_at":"2026-09-10T03:50:54.262435793Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"github.com/alexandre-daubois/ember","ecosystem":"Go","purl":"pkg:golang/github.com/alexandre-daubois/ember"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.2"}]}],"versions":[]}],"fixed_versions":[{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-x3g7-qrwc-f6c5","source_modified_at":"2026-09-10T03:50:54.262435793Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"github.com/alexandre-daubois/ember","ecosystem":"Go","purl":"pkg:golang/github.com/alexandre-daubois/ember"},"version":"1.4.2"}],"cvss":4.7,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T19:44:41.999Z","modified_at":"2026-10-28T19:44:41.999Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-54162","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28T19:44:41.999Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-x3g7-qrwc-f6c5","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-09-10T03:50:54.262435793Z"}],"sources":["CVE List","OSV"],"references":[{"source":"CVE List","url":"https://github.com/alexandre-daubois/ember/security/advisories/GHSA-x3g7-qrwc-f6c5","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/alexandre-daubois/ember/commit/fcb7160e58dba58d6f9b5033cc312fdedc8c9f6b","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/alexandre-daubois/ember/releases/tag/v1.4.2","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-28T19:44:41.999Z","content_hash":"1a02fa53762d8cc8e343500cc2ee249a8c91e10a6a570c37586ce5754f7e8af4"}}