Description

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain to_string_lossy() call in src/tree_build/builder.rs and in TreeLine::unprune in src/tree/tree_line.rs, and no control-character filtering exists anywhere in the code, even though the doc comment on the TreeLine name field states that some characters may have been stripped. Any local user who can create a file can therefore place an escape sequence in its name and have it written unmodified to the terminal of anyone who browses that directory, between broot's own styling codes. A reported proof of concept used an OSC 52 clipboard-write sequence and captured the raw bytes broot wrote to its pty, confirming the sequence reaches the terminal unstripped. What an injected OSC or CSI sequence can then do depends on the terminal emulator in use. Browsing a directory is broot's primary function and carries no expectation that the content is trusted.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.6",
  "pubDate": "2026-08-20T18:16:45.540Z",
  "pubdate": "2026-08-20T18:16:45.540Z",
  "executiveSummary": "A terminal escape sequence injection vulnerability exists in broot, allowing local users who can create files within a directory to craft malicious file or directory names containing raw control characters, such as OSC or CSI sequences.\nWhen a victim uses broot to browse an untrusted directory containing these specially crafted file names, the application renders the raw strings directly to the terminal emulator using plain to_string_lossy() calls without prior control-character sanitization or filtering.\nThe impact of this vulnerability depends on the specific terminal emulator in use by the victim, but it can lead to arbitrary terminal control, cursor manipulation, text injection, or silent data exfiltration via capabilities such as OSC 52 clipboard-write sequences.\nThe risk implications are significant because browsing directories is the primary function of broot and inherently carries no expectation that the filesystem content is trusted.\nAttacker capabilities are limited to local filesystem access where they can create files, and exploitation requires a victim to interactively browse the manipulated directory using the vulnerable application, causing the unstripped escape sequences to reach the terminal pty.",
  "technicalDetails": "The root cause of the vulnerability is the lack of input sanitization and control-character filtering when rendering filesystem entity names in the interactive tree view.\nSpecifically, file and directory names are converted using plain to_string_lossy() calls within src/tree_build/builder.rs and inside TreeLine::unprune located in src/tree/tree_line.rs.\nAlthough the internal documentation comments on the TreeLine name field explicitly state that some characters may have been stripped, the codebase performs no such filtering anywhere.\nThe vulnerable components are the tree building and rendering logic in broot, specifically involving the processing of untrusted filesystem names before they are written to the output terminal stream.\nAuthentication and privilege requirements are minimal for the attacker, who only requires local file creation privileges to drop a file with an engineered escape sequence name into a shared or target directory.\nThe network exposure is none, as the attack vector is strictly local via filesystem manipulation and terminal interaction.\nThe attack flow proceeds as follows: 1. A local attacker creates a file or directory with a name containing terminal escape sequences, such as an OSC 52 clipboard-write payload or ANSI control sequences. 2. A victim executes broot and navigates to the directory containing the malicious filename. 3. The application reads the raw filename from the filesystem and processes it via to_string_lossy(). 4. broot writes the resulting string unmodified directly to the terminal of the victim, situated between broot's own styling codes. 5. The victim's terminal emulator interprets the embedded escape sequences. 6. Depending on the terminal emulator's feature set, the payload executes, potentially modifying terminal state, injecting fake commands, or silently capturing and exfiltrating terminal data or clipboard contents."
}