CVE-2026-82584 json
Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata
published 2026-09-07 2 mo ago modified 2026-09-28 41 d ago also EEF-CVE-2026-82584 , EUVD-2026-72554 , GHSA-cj7w-j579-gc42
- cvss
- 2.3
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 44%
- public exploits
- 0
- none known
Summary
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt.
mix igniter.install prints a confirmation panel (an anti-typosquatting safeguard) listing a package's hex metadata before adding it. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields (meta.description, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency.
This issue affects igniter: from 0.8.1 before 0.8.4.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.53% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| hex | igniter | >=0.8.1, <0.8.4 |
0.8.4 |
Affected products
- ash-project igniter
Classification
- Weakness
-
- CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences
References
-
github.com
/ash-project/igniter/commit/d492b1aa33f8fb0dacc0afa41b703fb922d42816
patch
-
github.com
/ash-project/igniter/security/advisories/GHSA-cj7w-j579-gc42
vendor-advisory, related, advisory
-
cna.erlef.org
/cves/CVE-2026-82584.html
related, web
-
osv.dev
/vulnerability/EEF-CVE-2026-82584
related
-
hex.pm
/packages/igniter
package
Sources
- CVE List CVE-2026-82584
- NVD CVE-2026-82584
- OSV EEF-CVE-2026-82584
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.