CVE-2022-45063

What it actually does

Allows arbitrary command execution by crafting OSC 50 font responses containing control characters such as Ctrl-G that are interpreted as commands when echoed into Zsh's vi line-editing mode.

Why it matters to the business

Attackers can achieve full remote code execution on systems running vulnerable terminal emulators, enabling data theft, persistence, or further lateral movement; the issue has been public for years with limited observed exploitation.

How an attack unfolds

An attacker supplies malicious input that triggers an OSC 50 font operation response containing embedded control characters; when the response is processed and displayed inside Zsh running in vi mode, the control characters cause immediate command execution on the victim's host.

How to fix it

Upgrade xterm to version 375 or later on all affected systems; where immediate upgrade is not possible, disable font operations via the allowFontOps resource or equivalent configuration.

How to confirm the fix worked

Verify installed xterm version is 375 or newer; test that OSC 50 queries no longer produce responses containing raw control characters under Zsh vi mode.

Typical attack path

1. Identify a target process or session using an affected xterm version
2. Send crafted input or escape sequences that provoke an OSC 50 font query response
3. Embed control characters (e.g., Ctrl-G) inside the response payload
4. Trigger display of the response within Zsh vi-editing mode to execute the injected commands
5. Establish interactive access or run follow-on payloads

How to detect it

Review terminal session logs, shell history, and process creation events for unexpected command execution immediately following font-related escape sequences or OSC 50 responses; correlate with Zsh vi-mode usage.

What your security team should do

• Prioritize upgrade of xterm packages across all Linux distributions and developer workstations
• Audit terminal emulator configurations to ensure font operations remain disabled by default
• Monitor for new terminal-related CVEs and include terminal emulators in patch management SLAs