CVE-2026-73035

The record

npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --format homepage or --format repo option, unfiltered escape sequences are written directly to the terminal, enabling malicious output manipulation or other terminal-dependent effects.

Affected packages

Related vulnerabilities

• CVE-2026-54162 Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. CWE-150
• CVE-2026-55467 OpenPrinting CUPS is an open source printing system for Linux and other Unix-like… CWE-150
• CVE-2026-82710 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in… CWE-150
• CVE-2026-19591 OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS… CWE-150
• CVE-2026-75483 powerlevel10k fails to neutralize control characters in the package.json version field… CWE-150
• CVE-2026-73506 Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. CWE-150
• CVE-2026-73414 Shescape is a simple shell escape library for JavaScript. CWE-150
• CVE-2026-72913 Kitty is a cross-platform GPU based terminal. CWE-150