diff-so-fancy Terminal Escape Injection Flaw Fixed

A vulnerability in diff-so-fancy lets attackers embed malicious terminal control sequences that can spoof filenames, clear screens, or hijack clipboards during code review.

CERT Polska coordinated disclosure of CVE-2026-50642, a vulnerability in the popular diff-so-fancy tool used to improve the readability of git diffs. The tool only sanitizes ANSI SGR (color/formatting) sequences but fails to strip other terminal control sequences such as carriage returns, OSC, and CSI escape codes. This allows an attacker to craft filenames, diff metadata, or file content containing malicious escape sequences that get rendered directly in the victim's terminal when viewing a diff.

Exploitation could enable filename spoofing to mislead reviewers about what file is being changed, terminal screen clearing to hide malicious output, or clipboard injection via supported escape sequences — potentially leading to unintended command execution if a victim later pastes hijacked clipboard contents into a shell. This represents a supply-chain-adjacent risk during code review workflows, where a malicious pull request or repository could weaponize the flaw against a developer inspecting diffs.

The issue was responsibly reported by researchers Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team and has been fixed in commit 9c81294. No evidence of active exploitation is mentioned; this is a disclosure of a patched vulnerability rather than an ongoing attack campaign.

title: File Created or Modified with Embedded Terminal Escape Sequences in Filename
description: Detects file creation/rename events where the filename itself contains
  raw escape control characters (ESC, CSI, OSC sequences) rather than only printable
  characters. This is the core exploitation primitive behind terminal-injection flaws
  such as CVE-2026-50642 in diff-so-fancy, where crafted filenames or diff metadata
  containing non-SGR escape sequences are rendered verbatim by a victim's terminal
  to spoof content, clear the screen, or inject clipboard data. Generalises on the
  presence of control-sequence introducer bytes in the filename field, not on any
  specific payload or tool.
tags:
- attack.initial-access
- attack.t1204
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
    - "\e["
    - "\e]"
    - "\e["
    - "\e]"
  filter_common_tools:
    TargetFilename|contains:
    - /tmp/systemd-private
  condition: selection and not filter_common_tools
falsepositives:
- Legitimate tooling or test fixtures that intentionally embed escape sequences in
  filenames for terminal-rendering tests
- Binary or corrupted file transfers that coincidentally contain escape byte sequences
  in generated temp filenames
level: medium
id: 12603ba0-b597-5f70-a2ea-d409c59a5ca8
status: experimental
author: Vorant

title: Git Diff Pager Piped Through diff-so-fancy Rendering Content With Raw Escape
  Sequences
description: Detects command-line invocations of diff-so-fancy as a git pager where
  the command line or piped content includes raw OSC/CSI escape markers outside the
  standard SGR color range, consistent with CVE-2026-50642 exploitation during code
  review (filename spoofing, screen clearing, or clipboard injection via OSC 52).
tags:
- attack.initial-access
- attack.t1204
logsource:
  category: process_creation
  product: linux
detection:
  selection_process:
    Image|endswith: /diff-so-fancy
  selection_escape:
    CommandLine|contains:
    - "\e]"
    - "\e]"
    - "\eP"
    - "\eP"
  condition: selection_process and selection_escape
falsepositives:
- Developers manually testing terminal escape rendering or diff-so-fancy patches
- Automated CI pipelines that pass raw binary or log content through diff-so-fancy
  for formatting checks
level: low
id: fc049c44-9509-598c-a2c2-1e46f99cb31c
status: experimental
author: Vorant

Source reporting: https://cert.pl/en/posts/2026/07/CVE-2026-50642