GHSA-2p6r-x3vv-xqm2

What it actually does

The affected rpassword crate can leave terminal state or buffered input handling in an unsafe condition when password entry is interrupted, such as by a signal or aborted input sequence. In affected versions, this can result in part of the password being displayed or otherwise exposed to the local terminal/session instead of remaining fully hidden. The vulnerability is an information disclosure issue requiring user interaction during password entry; it does not provide direct remote code execution, privilege escalation, or authentication bypass by itself.

Why it matters to the business

Applications and command-line tools that use affected versions of rpassword may accidentally expose portions of sensitive passwords or secrets to a local screen, terminal scrollback, session recording, copy/paste buffer, or logs captured by terminal tooling. The operational risk is highest for administrative tools, deployment utilities, CI/CD helper scripts, and developer workflows where privileged credentials are entered interactively. Although the severity is relatively low and there is no known public exploitation, leaked credentials can still lead to account compromise if they are observed, recorded, or reused elsewhere.

How an attack unfolds

An attacker generally needs local visibility into the victim's terminal session or access to artifacts that capture terminal output, such as terminal scrollback, session recordings, multiplexers, support tooling, command transcripts, or shared console logs. The victim runs an application that depends on an affected rpassword version and begins entering a password. If input is interrupted at the vulnerable moment, part of the password may be revealed on screen or captured by surrounding tooling. The attacker then retrieves the exposed fragment and may combine it with observation, credential reuse, brute-force guessing, or other leaked information to compromise the associated account. This is not typically exploitable as a standalone remote attack; it is most relevant where terminal sessions are monitored, recorded, shared, or otherwise accessible to another party.

How to fix it

Upgrade rpassword to version 7.5.0 or later. For Rust projects, update Cargo.toml and Cargo.lock so that the resolved rpassword dependency is at least 7.5.0, then rebuild and redeploy any affected applications or CLI tools. If rpassword is pulled in transitively, update the parent dependency or use an appropriate dependency override only as a temporary measure. Where immediate upgrade is not possible, reduce exposure by avoiding interactive password entry in shared or recorded terminals, disabling terminal/session recording for password prompts where feasible, using non-interactive secret injection mechanisms with proper controls, and rotating any credentials that may have been entered during interrupted sessions.

How to confirm the fix worked

Confirm that all built artifacts resolve rpassword to version 7.5.0 or later by inspecting Cargo.lock, running dependency inspection tools such as cargo tree, and checking software composition analysis results. Rebuild applications after dependency updates rather than relying only on source changes. Validate behavior by testing password-entry interruption in a non-production environment and confirming that no typed password characters are echoed, retained in terminal scrollback, or captured in logs. Also verify that packaged binaries, containers, release artifacts, and downstream distributions have been rebuilt against the fixed dependency.

Typical attack path

1. Identify a CLI application or internal tool that uses a vulnerable rpassword version.
2. Gain visibility into the user's terminal output, terminal recording, shared console, support session, or captured logs.
3. Wait for or induce an interrupted password-entry event, such as a cancelled prompt or interrupted input sequence.
4. Observe or recover any partially revealed password characters from terminal output or related artifacts.
5. Use the leaked fragment to aid credential guessing, credential stuffing, or targeted account compromise.

How to detect it

This issue is difficult to detect reliably after the fact because exploitation may leave no application-specific artifact beyond visible or recorded terminal output. Review terminal session recordings, shell transcripts, support-session captures, CI/CD job logs, bastion audit recordings, tmux/screen logs, and centralized log collectors for password prompts followed by interruption indicators and unexpected echoed characters. Focus on sessions where affected CLI tools were run and the user cancelled or interrupted password entry. Look for signals such as Ctrl-C interruptions, terminated processes, aborted prompts, or password prompt text followed by visible non-control characters. If any credential exposure is suspected, treat the credential as compromised and rotate it. There are no known public exploit campaigns or named threat actors associated with this advisory at this time.

What your security team should do

• Prioritize upgrading all Rust applications and CLI tools that depend on rpassword to version 7.5.0 or later.
• Search source repositories, lockfiles, SBOMs, and artifact inventories for vulnerable rpassword versions.
• Identify high-risk use cases, especially administrator CLIs, deployment tools, CI/CD helper utilities, and tools used over shared, recorded, or remote terminal sessions.
• Rotate passwords or secrets that may have been entered into affected tools during interrupted prompts, particularly if terminal output was logged or recorded.
• Reduce use of interactive password prompts in automation; prefer managed secret stores, short-lived tokens, or secure non-interactive credential delivery.
• Educate operators not to enter sensitive credentials in shared screens, recorded sessions, or terminals with persistent scrollback when using unverified tooling.