CVE-2026-50642: diff-so-fancy Terminal Injection Vulnerability

CVE-2026-50642 Overview

CVE-2026-50642 affects diff-so-fancy, a tool that formats git diff output for improved terminal readability. The application strips ANSI Select Graphic Rendition (SGR) sequences but allows other control characters through unsanitized. Attackers can embed carriage returns, Operating System Command (OSC), and Control Sequence Introducer (CSI) escape sequences in filenames, diff metadata, or file content. When developers review a malicious diff, these sequences render directly in the terminal. The maintainers fixed the flaw in commit 9c81294. This weakness is classified as improper output encoding [CWE-116].

Critical Impact
Attackers can spoof filenames, clear terminal screens, and inject data into the user clipboard through OSC 52 sequences, potentially leading to unintended command execution during code review.

Affected Products

diff-so-fancy versions prior to commit 9c81294
Git workflows and code review pipelines that pipe untrusted diff data through diff-so-fancy
Terminal emulators that honor OSC and CSI control sequences (including clipboard OSC 52)

Discovery Timeline

2026-07-29 - CVE-2026-50642 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-50642

Vulnerability Analysis

The vulnerability stems from incomplete output neutralization. diff-so-fancy strips ANSI SGR sequences, which govern text color and style, but does not filter other escape sequence classes. Terminal emulators interpret a wide range of control characters beyond SGR, including OSC for window titles and clipboard operations, CSI for cursor movement, and carriage returns for line overwrites.

An attacker who controls filenames, commit content, or diff metadata in a repository can embed these sequences. When a reviewer runs git diff piped through diff-so-fancy, the terminal executes the sequences as rendering instructions rather than displaying them as literal text. This turns a passive code review into an active injection surface.

The impact scope is limited to the local terminal session but can undermine trust in diff output. See the CERT Polska analysis for background on related terminal injection issues.

Root Cause

The root cause is an allowlist gap in the sanitization routine. The code targets SGR sequences of the form ESC[...m but ignores OSC sequences (ESC]...BEL or ESC]...ST), CSI sequences that move the cursor or erase content, and raw carriage returns (\r) that reposition output on the current line.

Attack Vector

Exploitation requires that a victim view attacker-controlled diff data locally. An attacker commits a file whose name or contents contain escape sequences, or crafts a pull request whose diff metadata carries them. When the reviewer executes git diff or git show piped through diff-so-fancy, the terminal renders the payload.

Realistic payloads include OSC 52 sequences that write attacker-chosen text into the system clipboard, carriage returns that overwrite the visible filename with a benign one, and CSI erase sequences that hide malicious hunks from the reviewer. A subsequent paste by the victim can execute an injected command.

No verified public exploit code is available. The vulnerability mechanism is documented in the diff-so-fancy GitHub repository and the fix commit 9c81294.

Detection Methods for CVE-2026-50642

Indicators of Compromise

Files or filenames in repositories containing raw ESC (0x1B), BEL (0x07), or \r (0x0D) bytes outside of expected binary contexts
Commit metadata, branch names, or author fields containing escape sequences such as \\x1b]52;c; (OSC 52 clipboard write) or \\x1b[2J (CSI erase display)
Unexpected clipboard contents on developer workstations following a code review session

Detection Strategies

Scan repository contents and diff output for non-printable control characters before rendering, using tools such as cat -v or a preprocessor that flags 0x1B bytes
Compare installed diff-so-fancy commit hashes against 9c81294 or later across developer endpoints
Review shell history and clipboard managers for anomalous entries that appear immediately after git diff operations

Monitoring Recommendations

Log invocations of diff-so-fancy and git commands on developer workstations through endpoint telemetry
Alert on newly created files or branches whose names contain byte values below 0x20 other than tab and newline
Track deployments of the diff-so-fancy package across the fleet to confirm patch coverage

How to Mitigate CVE-2026-50642

Immediate Actions Required

Update diff-so-fancy to a version that includes commit 9c81294 or later
Audit repositories with external contributors for filenames or content containing escape sequences
Disable clipboard-write OSC sequences (OSC 52) in terminal emulator settings where feasible

Patch Information

The issue is fixed in diff-so-fancy commit 9c81294, available from the official GitHub repository. Rebuild or reinstall the package from the patched source, or upgrade via the package manager once a tagged release incorporating the commit is published.

Workarounds

Pipe diff output through a sanitizer such as col -b or sed 's/\\x1b\[[0-9;]*[a-zA-Z]//g; s/\\x1b\][^\\x07]*\\x07//g' before rendering
Configure the terminal emulator to reject OSC 52 clipboard writes and to render control characters as literal text
Review untrusted diffs with git diff --no-color | cat -v to expose embedded control bytes

bash

# Configuration example
# Update diff-so-fancy to the patched commit
cd /path/to/diff-so-fancy
git fetch origin
git checkout 9c81294

# Verify the installed version
which diff-so-fancy
diff-so-fancy --version

# Optional: strip residual escape sequences before display
git diff --no-color | diff-so-fancy | sed -E 's/\\x1b\][^\\x07]*(\\x07|\\x1b\\)//g'