Description

procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute processes with malicious ANSI or OSC escape sequences in their command line arguments, which are written unmodified to other users' terminals for interpretation by terminal emulators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.2",
  "pubDate": "2026-09-13T11:17:01.967Z",
  "pubdate": "2026-09-13T11:17:01.967Z",
  "executiveSummary": "The procs utility, in versions through 0.14.12, is vulnerable to an ANSI/OSC escape sequence injection vulnerability. The flaw exists due to a lack of input sanitization when the application processes command line arguments for display within the 'Command' column. A local attacker can intentionally spawn a process with crafted command line arguments containing terminal escape codes. When an unsuspecting user runs procs, these malicious sequences are rendered by the user's terminal emulator as if they were legitimate control commands. This vulnerability enables a local attacker to manipulate the victim's terminal environment, potentially leading to unauthorized command execution, terminal state modification, or exfiltration of sensitive information depending on the specific escape sequences supported by the victim's terminal emulator. This is a local-only attack vector that does not require network access, though it necessitates that the attacker have sufficient privileges to execute processes on the target system.",
  "technicalDetails": "The vulnerability resides within the procs command-line utility, specifically in the module responsible for parsing and rendering the 'Command' column in the process display. The root cause is an improper neutralization of terminal control sequences (ANSI/OSC) present in the command lines of active processes. Because procs outputs these command strings directly to the standard output of the user's terminal without sanitization or escaping, the terminal emulator interprets embedded escape sequences as instructions rather than plain text.\nThe attack flow begins when an attacker executes a malicious process using a crafted command line, for example: 'procs_test_process \\u001b[2J'. The '\\u001b[2J' sequence instructs many terminal emulators to clear the screen. When a victim subsequently runs the procs command while the malicious process is active, the procs utility reads the command line, including the injected sequence, and writes it to the terminal emulator. The terminal emulator receives the raw string from the stdout stream and executes the ANSI escape instruction, resulting in the desired manipulation.\nThe impact of this injection can range from benign UI disruption (e.g., clearing the screen, changing text colors, or moving the cursor) to severe security compromises. Advanced escape sequences, such as Operating System Commands (OSC), can be leveraged in specific terminal emulators to change terminal titles, write to the clipboard, or potentially trigger hidden command execution via buffer overflow or feature-specific vulnerabilities in the terminal emulator itself. This requires no authentication, as the attacker is interacting with system-level process information, and it requires no special network exposure, operating entirely within the local user session. The attack effectively utilizes the victim's own terminal as a vector to perform actions on their behalf or to manipulate their visual output, potentially masking malicious activities or facilitating social engineering."
}