CVE-2026-48813: Flawfinder XSS Vulnerability

CVE-2026-48813 Overview

Flawfinder is a static analysis tool used to identify vulnerabilities in C/C++ source code. Versions prior to 2.0.20 contain an improper input neutralization flaw that enables output manipulation through Terminal/ANSI Escape Sequence Injection and XML Injection. Attackers can craft filenames or file contents containing ANSI escape sequences that flawfinder writes directly to terminal output. The same weakness lets attackers corrupt CSV reports and inject arbitrary XML attributes into SonarQube outputs generated via output_sonar(). This issue impacts users who run flawfinder against intentionally malicious filenames or file contents, such as third-party or untrusted code repositories. The flaw is tracked under CWE-74: Improper Neutralization of Special Elements in Output.

Critical Impact
Attackers who control filenames or file contents scanned by flawfinder can manipulate terminal output, corrupt CSV reports, and inject arbitrary XML attributes into SonarQube integration data, compromising the integrity of downstream security tooling.

Affected Products

Flawfinder versions prior to 2.0.20
Downstream pipelines consuming flawfinder CSV output
SonarQube integrations consuming flawfinder XML output via output_sonar()

Discovery Timeline

2026-05-16 - Flawfinder version 2.0.20 released with the fix
2026-08-11 - CVE-2026-48813 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-48813

Vulnerability Analysis

The vulnerability stems from flawfinder failing to sanitize untrusted fields before writing them to terminal or structured report outputs. Filenames, category strings, and code context text pass through the reporting pipeline without neutralization of shell control characters or markup metacharacters. When flawfinder scans attacker-controlled sources, these values reach the analyst's terminal or a downstream parser unchanged.

For terminal output, a filename containing ANSI escape sequences can rewrite prior lines, hide findings, or alter perceived scan results. For CSV output, unescaped commas, quotes, or newlines corrupt row structure and can trigger CSV injection when opened in spreadsheet applications. For XML output produced by output_sonar(), unescaped attribute characters allow injection of arbitrary XML attributes into the SonarQube report, tampering with issue metadata ingested by SonarQube.

Root Cause

The root cause is missing output-context-specific neutralization for user-controlled string fields. Flawfinder treats file paths, categories, and source context as trusted text when constructing its reports. The tool applies neither ANSI stripping for terminal writes nor attribute-safe XML encoding when emitting SonarQube data.

Attack Vector

An attacker plants files with crafted names or contents in a repository, archive, or directory that a developer or CI/CD pipeline later scans with flawfinder. No authentication is required, and the attacker never interacts with the scanning host directly. The malicious payload activates when flawfinder writes its report, affecting either the analyst viewing the terminal or the automated system parsing the CSV or SonarQube XML.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-4c3c-r6p8-c863 for technical details.

Detection Methods for CVE-2026-48813

Indicators of Compromise

Filenames containing raw ANSI escape sequences (\\x1b[ or ESC[) in source repositories staged for scanning
Flawfinder CSV reports with malformed rows, embedded quotes, or unexpected newlines inside fields
SonarQube XML reports containing unexpected attributes or nested tags within <issue> or <file> elements
Terminal scrollback showing cursor movement or color changes not produced by flawfinder itself

Detection Strategies

Inventory build agents and developer workstations to identify installed flawfinder versions below 2.0.20
Parse historical flawfinder output artifacts for control characters (0x1B) and malformed CSV or XML tokens
Alert on scan jobs that ingest repositories from untrusted contributors while running flawfinder versions earlier than 2.0.20

Monitoring Recommendations

Monitor CI/CD job logs for unexpected escape sequences or SonarQube ingestion errors following flawfinder execution
Track file creation events for filenames containing shell metacharacters or non-printable bytes
Review SonarQube audit logs for issue records with abnormal attribute sets originating from flawfinder imports

How to Mitigate CVE-2026-48813

Immediate Actions Required

Upgrade flawfinder to version 2.0.20 or later on all developer workstations, build agents, and CI/CD runners
Audit recent flawfinder outputs consumed by SonarQube or spreadsheet tooling for evidence of injection
Restrict flawfinder execution to repositories with vetted contributors until the upgrade completes

Patch Information

The issue was fully patched in flawfinder version 2.0.20, released 2026-05-16. Upgrade instructions and release notes are available in the GitHub Security Advisory GHSA-4c3c-r6p8-c863. No configuration-based workaround exists within older versions.

Workarounds

Pre-scan repository filenames and reject or rename any file whose name contains non-printable or control characters before invoking flawfinder
Inspect raw flawfinder output with a tool that renders escape sequences literally, such as cat -v or less -R disabled
Redirect flawfinder output to a file and post-process it with a sanitizer before displaying in a terminal or importing into SonarQube
Restrict flawfinder to trusted input paths and isolate scans of untrusted code in a sandboxed environment

bash

# Upgrade flawfinder using pip
pip install --upgrade 'flawfinder>=2.0.20'

# Verify installed version
flawfinder --version

# Pre-filter filenames containing control characters before scanning
find . -type f ! -name '*[[:cntrl:]]*' -print0 | \
  xargs -0 flawfinder --csv > scan-results.csv