{"id":"EEF-CVE-2026-82710","summary":"Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata","details":"## Summary\n\nImproper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal control sequences into the output of `mix usage_rules.search_docs`.\n\n`mix usage_rules.search_docs` searches Hex documentation through `search.hexdocs.pm`, which indexes the documentation of every published package, and prints the matching results (title, package, type, doc reference, and highlighted snippets) to the terminal. The formatter in `Mix.Tasks.UsageRules.SearchDocs` interpolated those publisher-controlled fields verbatim, neutralizing no terminal control characters; the only transform it applied adds escape sequences rather than removing them. A malicious package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) in its indexed documentation, so when a developer runs a search that surfaces those docs the sequences reach the terminal unchanged — forging the displayed hexdocs URL or a suggested command, hiding text, or writing to the clipboard. No authentication or privileged position is required; only publishing a package.\n\nThis issue affects usage_rules: from 0.1.18 before 1.2.8.\n\n## Configurations\n\nReachable only when a developer runs `mix usage_rules.search_docs` in a terminal emulator that interprets ANSI escape sequences and the results include documentation from an attacker-published package (for example a broad `--everywhere` search).","aliases":["CVE-2026-82710","GHSA-j59f-776f-23hp"],"modified":"2026-09-09T00:30:03.516389493Z","published":"2026-09-08T00:23:36.912Z","database_specific":{"cwe_ids":["CWE-150"],"capec_ids":["CAPEC-93"],"cpe_ids":["cpe:2.3:a:ash-project:usage_rules:*:*:*:*:*:*:*:*"]},"references":[{"type":"ADVISORY","url":"https://github.com/ash-project/usage_rules/security/advisories/GHSA-j59f-776f-23hp"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-82710.html"},{"type":"FIX","url":"https://github.com/ash-project/usage_rules/commit/3b8ebb4117d3272bbd436e6c2432113ba6685dbb"},{"type":"PACKAGE","url":"https://hex.pm/packages/usage_rules"}],"affected":[{"package":{"name":"usage_rules","ecosystem":"Hex","purl":"pkg:hex/usage_rules"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.18"},{"fixed":"1.2.8"}]}],"versions":["0.1.18","0.1.19","0.1.20","0.1.21","0.1.22","0.1.23","0.1.24","0.1.25","0.1.26","1.0.0-rc.0","1.0.0-rc.1","1.0.0-rc.2","1.0.0-rc.3","1.0.1","1.0.2","1.0.3","1.1.0","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-82710.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/ash-project/usage_rules","events":[{"introduced":"2da7a99536041d63ec1f391d019565789a59595f"},{"fixed":"3b8ebb4117d3272bbd436e6c2432113ba6685dbb"}]}],"versions":["v1.2.7","v1.2.6","v1.2.5","v1.2.4","v1.2.3","v1.2.2","v1.2.1","v1.2.0","v1.1.0","v1.0.3","v1.0.1","v1.0.0-rc.3","v1.0.0-rc.2","v1.0.0-rc.1","v1.0.0-rc.0","v0.1.26","v0.1.25","v0.1.24","v0.1.23","v0.1.22","v0.1.21","v0.1.20","v0.1.19","v0.1.18"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-82710.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}],"credits":[{"name":"Peter Ullrich","type":"FINDER"},{"name":"Peter Ullrich","type":"REPORTER"},{"name":"Zach Daniel / Ash Project","type":"REMEDIATION_DEVELOPER"},{"name":"Jonatan Männchen / EEF","type":"COORDINATOR"}]}