CVE-2026-40505

The record

MuPDF before 1.27 contains an ANSI injection vulnerability in mutool that allows attackers to inject arbitrary ANSI escape sequences through crafted PDF metadata fields. Attackers can embed malicious ANSI escape codes in PDF metadata that are passed unsanitized to terminal output when running mutool info, enabling them to manipulate terminal display for social engineering attacks such as presenting fake prompts or spoofed commands.

Affected packages

Related vulnerabilities

• CVE-2026-55467 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-150
• CVE-2026-82710 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in… CWE-150
• CVE-2026-19591 OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS… CWE-150
• CVE-2026-73506 Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. CWE-150
• CVE-2026-73414 Shescape is a simple shell escape library for JavaScript. CWE-150
• CVE-2026-72913 Kitty is a cross-platform GPU based terminal. CWE-150
• CVE-2026-64654 GitHub CLI (gh) is GitHub's official command line tool. CWE-150
• CVE-2026-49147 App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences… CWE-150