CVE-2026-73035: npm-check-updates Terminal Injection Flaw

CVE-2026-73035 Overview

CVE-2026-73035 is a terminal escape sequence injection vulnerability in npm-check-updates (ncu) through version 23.0.2. The tool fails to sanitize the homepage and repository URL fields sourced from dependency package.json files. When a developer runs ncu with the --format homepage or --format repo option, unfiltered escape sequences are written directly to the terminal. An attacker who publishes a malicious package can embed arbitrary terminal control characters that manipulate output, hide commands, or overwrite prior terminal content. The issue is tracked as CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences and was fixed in commit b554b84.

Critical Impact
A malicious npm dependency can inject terminal control sequences into a developer's shell, enabling output spoofing and command masking that may lead to trust-based supply chain deception.

Affected Products

npm-check-updates versions through 23.0.2
Developer workstations running ncu --format homepage
Developer workstations running ncu --format repo

Discovery Timeline

2026-08-10 - CVE-2026-73035 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-73035

Vulnerability Analysis

The vulnerability resides in the logging path of npm-check-updates. When users request output formatted with --format homepage or --format repo, the tool reads the homepage and repository.url fields from each dependency's package.json and prints them to standard output without filtering. Terminal emulators interpret ANSI/VT control sequences embedded in that text, so any escape codes present in a dependency's metadata are executed by the terminal rather than displayed as literal characters. An attacker who controls a package can therefore reposition the cursor, rewrite prior output, clear the screen, alter colors, or spoof success messages during a routine dependency check.

Root Cause

The root cause is missing neutralization of control characters in the logging module. String values pulled from package manifests were concatenated into terminal output without passing through an escape-stripping routine, violating the guidance captured under CWE-150.

Attack Vector

Exploitation requires an attacker to publish or compromise an npm package whose homepage or repository field contains crafted escape sequences. A developer who lists that package as a dependency and then runs ncu --format homepage or ncu --format repo triggers the injection. The attack requires user interaction (running the affected command) but no authentication, and the malicious payload travels through the standard npm registry.

typescript

// Security patch in src/lib/logging.ts (commit b554b84)
// Strip terminal escape sequences from package and registry text (#1994)
 * Logging functions.
 */
import fs from 'node:fs/promises'
+import { stripVTControlCharacters } from 'node:util'
import Table from 'cli-table3'
import semver from 'semver'
import { type CooldownFunction } from '../types/CooldownFunction.ts'

Source: GitHub commit b554b84. The fix imports Node.js stripVTControlCharacters and applies it to package and registry text before rendering.

Detection Methods for CVE-2026-73035

Indicators of Compromise

Dependency package.json files containing non-printable bytes (ESC 0x1B, CSI sequences) in homepage or repository.url fields.
Shell session recordings showing cursor repositioning, unexpected screen clears, or color changes during ncu execution.
Installed npm-check-updates versions at or below 23.0.2 in developer environments and CI runners.

Detection Strategies

Scan cached node_modules and lockfiles for control characters in dependency metadata using a regular expression such as /[\\x00-\\x08\\x0B-\\x1F\\x7F]/ against homepage and repository.url values.
Inventory developer and build-agent hosts for the installed npm-check-updates version via npm ls -g npm-check-updates or SBOM data.
Correlate CI job logs for anomalous ANSI sequences emitted during dependency-update stages.

Monitoring Recommendations

Alert on new or updated npm packages whose manifest fields contain non-printable characters at ingestion time in internal registries.
Track process execution telemetry for ncu invocations with --format homepage or --format repo arguments on developer endpoints.
Review terminal session recordings from privileged build users to identify unexpected escape-driven output during package operations.

How to Mitigate CVE-2026-73035

Immediate Actions Required

Upgrade npm-check-updates to a version that includes commit b554b84 on every developer workstation and CI runner.
Audit dependency manifests for embedded control characters in homepage and repository.url before running formatted ncu output.
Restrict ncu --format homepage and --format repo usage in shared or automated environments until upgrades are complete.

Patch Information

The maintainer resolved the issue by importing stripVTControlCharacters from Node.js node:util and applying it to package and registry text in src/lib/logging.ts. See the fix commit b554b84, the associated issue #1988, pull request #1994, and the VulnCheck advisory.

Workarounds

Avoid the --format homepage and --format repo options until an upgraded ncu is installed.
Pipe ncu output through a filter that removes ANSI escape sequences, for example ncu --format homepage | perl -pe 's/\e\[[0-9;]*[a-zA-Z]//g'.
Pin dependencies to trusted publishers and enforce manifest linting in the CI pipeline to reject packages containing control characters.

bash

# Upgrade npm-check-updates and verify the installed version
npm install -g npm-check-updates@latest
ncu --version

# Strip escape sequences from ncu output as a temporary safeguard
ncu --format homepage | sed -r "s/\\x1B\[[0-9;]*[a-zA-Z]//g"