Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-82584: Igniter installer can display forged confirmation prompts
CVE-2026-82584 · published 1 month ago
Summary
When a package is being added, Igniter shows a confirmation screen that lists information supplied by the package publisher. A malicious publisher can hide special characters in that information to change what is shown, making the screen display false author names or download numbers. Update Igniter to version 0.8.4 or later to stop this manipulation.
What to do
- Update igniter to version 0.8.4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | ash-project | igniter |
< 0.8.4 < d492b1aa33f8fb0dacc0afa41b703fb922d42816 |
| Hex | – | igniter |
>= 0.8.1, < 0.8.4 Fix: upgrade to 0.8.4
|
Original advisory text
Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt.
mix igniter.install prints a confirmation panel (an anti-typosquatting safeguard) listing a package's hex metadata before adding it. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields (meta.description, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency.
This issue affects igniter: from 0.8.1 before 0.8.4.
mix igniter.install prints a confirmation panel (an anti-typosquatting safeguard) listing a package's hex metadata before adding it. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields (meta.description, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency.
This issue affects igniter: from 0.8.1 before 0.8.4.
References
- https://github.com URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82584... Vendor Advisory
- https://github.com/ash-project/igniter Product
- https://repo.hex.pm URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-82584 Vendor Advisory
- https://hex.pm/packages/igniter Product
- https://cna.erlef.org/cves/CVE-2026-82584.html URL
- https://github.com/ash-project/igniter/security/advisories/GHSA-cj7w-j579-gc42 Vendor Advisory
- https://osv.dev/vulnerability/EEF-CVE-2026-82584 URL
- https://github.com/ash-project/igniter/commit/d492b1aa33f8fb0dacc0afa41b703fb922... Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
7.8
High
Type
CWE-150Improper Neutralization of Escape, Meta, or Control Sequences
Timeline
Published7 Sep 2026
Updated4 Nov 2026
First seen8 Sep 2026
Sources
CVE-2026-82584 · NVD
CVE-2026-82584 · MITRE
CVE-2026-82584 · OSV
GHSA-cj7w-j579-gc42 · GHSA
EEF-CVE-2026-82584 · OSV
Track software like this
Free during beta