Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

diff-so-fancy may let attackers manipulate terminal output

CVE-2026-50642 · published 3 months ago
Summary

The diff‑so‑fancy tool can pass certain hidden control codes to the terminal when displaying differences, which could be used to change what is shown or affect the clipboard. An attacker could place these codes in file names or file contents and trick users during code reviews. Upgrade to the version that includes the recent fix or apply the provided patches to stop the unsafe characters from being displayed.

Original advisory text
Terminal Escape Injection in diff‑so‑fancy
diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences while allowing other control characters, including carriage return (\r) and escape sequences (e.g., OSC, CSI), to pass through unsanitized.

An attacker can embed malicious control sequences in filenames, diff metadata, or file content that are rendered directly in the terminal during diff viewing. This can lead to output manipulation, including filename spoofing, terminal screen clearing, and clipboard injection via supported escape sequences.

Successful exploitation may mislead users during code review, alter terminal state, or result in unintended command execution through clipboard hijacking.

This issue has been fixed in the commit 9c81294
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.8 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-116Improper Encoding or Escaping of Output
Timeline
Published29 Jul 2026
Updated4 Nov 2026
First seen29 Jul 2026
Sources
CVE-2026-50642 · NVD
CVE-2026-50642 · OSV
Track software like this
Free during beta