Description

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --format homepage or --format repo option, unfiltered escape sequences are written directly to the terminal, enabling malicious output manipulation or other terminal-dependent effects.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-10T21:17:26.760Z",
  "pubdate": "2026-08-10T21:17:26.760Z",
  "executiveSummary": "npm-check-updates through 23.0.2 contains a terminal escape sequence injection vulnerability that allows an attacker to execute terminal manipulation via malicious dependency metadata.\nThe vulnerability affects npm-check-updates through version 23.0.2, specifically impacting users who execute the tool with the --format homepage or --format repo option.\nAn attacker can embed arbitrary terminal control characters within a dependency's package.json homepage or repository URL fields.\nWhen a developer processes these dependencies using the vulnerable formatting options, the unfiltered escape sequences are rendered directly to the terminal.\nThis enables malicious output manipulation, spoofing terminal UI elements, or triggering other terminal-dependent effects in the victim's environment.\nNo authentication or elevated privileges are required, but successful exploitation relies on the victim executing npm-check-updates with specific formatting flags against a repository containing the malicious package.json fields.",
  "technicalDetails": "The root cause of the vulnerability lies in the lack of sanitization or filtering of string values retrieved from dependency package.json files—specifically the homepage and repository URL fields—before rendering them in the terminal interface.\nThe vulnerable components are triggered when the user executes npm-check-updates with the --format homepage or --format repo command-line options.\nAffected versions include npm-check-updates through 23.0.2.\nThe attack flow proceeds as follows: First, an attacker publishes a malicious package or compromises an existing dependency, inserting ANSI escape sequences or other terminal control characters into the homepage or repository URL parameters of the package.json file.\nSecond, a developer integrates this dependency into their project and executes npm-check-updates utilizing the vulnerable formatting flags (--format homepage or --format repo).\nThird, the application parses the dependency metadata and writes the raw, unfiltered strings containing the terminal control characters directly to standard output.\nAs the terminal interprets these escape sequences, the payload behavior manifests as unintended output manipulation. This can corrupt terminal displays, obfuscate actual update information, spoof command prompts, or execute terminal-dependent side effects depending on the capabilities of the victim's terminal emulator.\nNo network exposure is directly required for the vector itself beyond the standard acquisition of the dependency, and no authentication or privilege levels are needed within the local environment, as the payload executes automatically within the security context of the developer's active terminal session upon rendering."
}