Skip to content
Heist/ feed
Back to feed
Low

procs through 0.14.12 Terminal Escape Sequence Injection via Command

Type: advisorySources: OSV

procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute processes with malicious ANSI or OSC escape sequences in their command line arguments, which are written unmodified to other users' terminals for interpretation by terminal emulators.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-90773
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 14:00 UTC · Revision 1

Source evidence

procs through 0.14.12 Terminal Escape Sequence Injection via Command

core-osv · Original source

Published 13 Sept 2026, 10:45 UTC

procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute processes with malicious ANSI or OSC escape sequences in their command line arguments, which are written unmodified to other users' terminals for interpretation by terminal emulators.

osv:CVE-2026-90773
Complete source record
{
  "id": "5d5c45a197449950d22b346b948e9ba5d39d19976d7a394bdd4386475f698c24",
  "url": "https://osv.dev/vulnerability/CVE-2026-90773",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "procs through 0.14.12 Terminal Escape Sequence Injection via Command",
    "summary": "procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute processes with malicious ANSI or OSC escape sequences in their command line arguments, which are written unmodified to other users' terminals for interpretation by terminal emulators.",
    "evidence": "osv:CVE-2026-90773",
    "products": [],
    "severity": "low",
    "structured": {
      "id": "CVE-2026-90773",
      "aliases": [
        "CVE-2026-90773"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/dalance/procs",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "a064cec7d59f69a636d38e247824245dcd3a9836"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "0.14.12"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "a064cec7d59f69a636d38e247824245dcd3a9836"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v0.14.12",
            "v0.14.11",
            "v0.14.10",
            "v0.14.9",
            "v0.14.8",
            "v0.14.7",
            "v0.14.6",
            "v0.14.5",
            "v0.14.4",
            "v0.14.3",
            "v0.14.2",
            "v0.14.1",
            "v0.14.0",
            "v0.13.4",
            "v0.13.3",
            "v0.13.2",
            "v0.13.1",
            "v0.13.0",
            "v0.12.3",
            "v0.12.2",
            "v0.12.1",
            "v0.12.0",
            "v0.11.13",
            "v0.11.12",
            "v0.11.11",
            "v0.11.10",
            "v0.11.9",
            "v0.11.8",
            "v0.11.7",
            "v0.11.6",
            "v0.11.5",
            "v0.11.4",
            "v0.11.3",
            "v0.11.2",
            "v0.11.1",
            "v0.11.0",
            "v0.10.10",
            "v0.10.9",
            "v0.10.8",
            "v0.10.7",
            "v0.10.6",
            "v0.10.5",
            "v0.10.4",
            "v0.10.3",
            "v0.10.2",
            "v0.10.1",
            "v0.10.0",
            "v0.9.20",
            "v0.9.19",
            "v0.9.18",
            "v0.9.17",
            "v0.9.16",
            "v0.9.12",
            "v0.9.11",
            "v0.9.9",
            "v0.9.8",
            "v0.9.7",
            "v0.9.6",
            "v0.9.5",
            "v0.9.4",
            "v0.9.2",
            "v0.9.1",
            "v0.9.0",
            "v0.8.16",
            "v0.8.15",
            "v0.8.14",
            "v0.8.13",
            "v0.8.12",
            "v0.8.11",
            "v0.8.10",
            "v0.8.9",
            "v0.8.8",
            "v0.8.7",
            "v0.8.6",
            "v0.8.5",
            "v0.8.4",
            "v0.8.3",
            "v0.8.2",
            "v0.8.1",
            "v0.8.0",
            "v0.7.6",
            "v0.7.5",
            "v0.7.4",
            "v0.7.3",
            "v0.7.2",
            "v0.7.1",
            "v0.7.0",
            "v0.6.0",
            "v0.5.8",
            "v0.5.7",
            "v0.5.6",
            "v0.5.5",
            "v0.5.4",
            "v0.5.3",
            "v0.5.2",
            "v0.5.1",
            "v0.5.0",
            "v0.4.8",
            "v0.4.7",
            "v0.4.6",
            "v0.4.5",
            "v0.4.4",
            "v0.4.3",
            "v0.4.2",
            "v0.4.1",
            "v0.4.0",
            "v0.3.5",
            "v0.3.4",
            "v0.3.3",
            "v0.3.2",
            "v0.3.1",
            "v0.3.0",
            "v0.2.2",
            "v0.2.1",
            "v0.2.0",
            "v0.1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90773.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:36.084805406Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90773.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-90773",
        "https://www.vulncheck.com/advisories/procs-through-0.14.12-terminal-escape-sequence-injection-via-command",
        "https://github.com/dalance/procs/issues/950",
        "https://github.com/dalance/procs/commit/a064cec7d59f69a636d38e247824245dcd3a9836",
        "https://github.com/dalance/procs",
        "https://github.com/dalance/procs/blob/v0.14.12/src/columns/command.rs"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-150"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90773.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-90773",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 503396,
  "published_at": "2026-09-13T10:45:43.955+00:00"
}