CVE-2026-54162

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54162
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-54162.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-54162
Aliases
Downstream
Related
Published
2026-10-28T19:44:41Z
Modified
2026-10-31T02:34:22Z
Severity
  • 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N CVSS Calculator
Summary
Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUI
Details

Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row formatters pass Caddy access-log fields, particularly the request URI, through the fitCellLeft render helper without neutralizing terminal escape or control sequences. An unauthenticated remote client can place ANSI, OSC, or CSI control bytes in an ordinary HTTP request target. Caddy JSON-escapes those bytes, ParseLogLine decodes them back into raw controls, and the formatters concatenate them into View() output reaching os.Stdout. When the operator views the default Logs tab, the terminal interprets these sequences, allowing monitoring-dashboard spoofing, clipboard hijacking through OSC 52, and window-title spoofing through OSC 0/2. This works even with a loopback-only log listener because the input arrives through normal Caddy access logs. Certificates and Routes share secondary unneutralized render sinks. The --json, --once, and daemon --expose modes are unaffected because they do not render an interactive terminal. Consequences depend on the terminal emulator and usually require further operator action to escalate; this is not general-purpose remote code execution. This issue is fixed in version 1.4.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-150"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54162.json"
}
References

Affected packages

Git / github.com/alexandre-daubois/ember

Affected ranges

Type
GIT
Repo
https://github.com/alexandre-daubois/ember
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
85c3ffafbf89f759dfd195433ac3371f7ad56090
Fixed
fcb7160e58dba58d6f9b5033cc312fdedc8c9f6b
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.4.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "fcb7160e58dba58d6f9b5033cc312fdedc8c9f6b"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v1.4.2",
            "range": [
                {
                    "fixed": "85c3ffafbf89f759dfd195433ac3371f7ad56090"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v1.*
v1.0.0
v1.0.1
v1.1.0
v1.2.0
v1.3.0
v1.4.0
v1.4.1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-54162.json"