CVE-2026-82710: ash-project usage_rules XSS Vulnerability

CVE-2026-82710 Overview

CVE-2026-82710 is a terminal control sequence injection vulnerability in the ash-project usage_rules Elixir library. The flaw resides in Mix.Tasks.UsageRules.SearchDocs, which powers the mix usage_rules.search_docs task. The formatter interpolates publisher-controlled fields from Hex documentation directly into terminal output without neutralizing ANSI escape sequences. A malicious package author can embed cursor movement, line erase, carriage return, or OSC 52 clipboard write sequences in indexed documentation. When a developer runs a search that surfaces the malicious documentation, the sequences reach the terminal unchanged. No authentication or privileged access is required beyond publishing a Hex package. The issue is tracked under [CWE-150] and affects usage_rules from 0.1.18 before 1.2.8.

Critical Impact
Malicious package publishers can forge terminal output, hide text, spoof hexdocs URLs, suggest attacker-controlled commands, or write to the developer's clipboard via OSC 52.

Affected Products

ash-project usage_rules versions 0.1.18 through 1.2.7
Elixir Mix task mix usage_rules.search_docs
Developer terminals that render ANSI and OSC escape sequences

Discovery Timeline

2026-09-08 - CVE-2026-82710 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-82710

Vulnerability Analysis

The mix usage_rules.search_docs task queries search.hexdocs.pm, which indexes documentation for every published Hex package. The task prints matching results — title, package, type, doc reference, and highlighted snippets — directly to the terminal. Each of these fields is publisher-controlled metadata.

The formatter in Mix.Tasks.UsageRules.SearchDocs interpolated these values verbatim. The only transformation applied added ANSI sequences for highlighting rather than removing hostile ones. As a result, escape characters embedded in a package's documentation traverse the pipeline intact and are interpreted by the developer's terminal emulator. This behavior maps to Improper Neutralization of Escape, Meta, or Control Sequences.

Root Cause

The root cause is missing sanitization of untrusted string fields before writing to a terminal that interprets ANSI and OSC control sequences. The formatter treated indexed documentation as trusted display data, when in fact any Hex package publisher can supply arbitrary bytes in title, package, type, ref, and highlight fields.

Attack Vector

An attacker publishes a Hex package whose documentation contains crafted escape sequences. When any developer runs mix usage_rules.search_docs with a query that matches the malicious package, the terminal renders attacker-chosen effects. Practical abuse includes forging the displayed hexdocs URL for a legitimate-looking package, overwriting prior lines to suggest a malicious install command, hiding text on screen, or issuing an OSC 52 sequence to write attacker-controlled content to the user's clipboard for later paste-and-execute.

text

       "highlights" => highlights
     } = hit
 
+    # Every field here is publisher-controlled documentation metadata indexed by
+    # search.hexdocs.pm and printed straight to the terminal. Strip control
+    # characters so a package cannot inject terminal escape sequences (forged
+    # output, hidden text, OSC 52 clipboard writes). This runs before the
+    # <mark> -> ANSI conversion so the highlighting we add intentionally is kept.
+    title = terminal_safe(title)
+    package = terminal_safe(package)
+    type = terminal_safe(type)
+    ref = terminal_safe(ref)
+
     # Calculate global result number
     global_index = (current_page - 1) * per_page + index

Source: GitHub commit 3b8ebb4. The patch introduces a terminal_safe/1 helper and applies it to each publisher-controlled field before rendering, preserving intentional <mark> to ANSI highlight conversion.

Detection Methods for CVE-2026-82710

Indicators of Compromise

Presence of usage_rules dependency at a version in the range 0.1.18 to 1.2.7 in mix.exs or mix.lock.
Unexpected clipboard contents on developer workstations after running mix usage_rules.search_docs.
Terminal scrollback containing raw \e[, \e]52;, or bare carriage return sequences from Hex search output.

Detection Strategies

Scan repository lockfiles for vulnerable usage_rules versions across developer and CI environments.
Inspect terminal recordings and shell history for mix usage_rules.search_docs invocations preceding suspicious clipboard or shell activity.
Review outbound network telemetry from developer hosts for unexpected requests to hexdocs URLs that differ from the URLs displayed in the terminal.

Monitoring Recommendations

Alert on installations of newly published Hex packages by developer accounts shortly after documentation searches.
Monitor endpoint process telemetry for mix invocations spawning unexpected child processes such as shells or package installers.
Track clipboard-writing OSC 52 sequences at the terminal emulator level where supported.

How to Mitigate CVE-2026-82710

Immediate Actions Required

Upgrade usage_rules to version 1.2.8 or later across all developer and CI environments.
Audit recent uses of mix usage_rules.search_docs and review shell history and clipboard activity for suspicious commands.
Advise developers not to paste terminal output or clipboard contents into shells without inspecting them first.

Patch Information

The fix is delivered in usage_rules1.2.8 via GitHub commit 3b8ebb4. Additional details are available in GHSA-j59f-776f-23hp, the Erlang Ecosystem Foundation CNA advisory, and the OSV entry EEF-CVE-2026-82710.

Workarounds

Avoid running mix usage_rules.search_docs until the dependency is upgraded to 1.2.8.
Pipe task output through a filter that strips ANSI and OSC control bytes before display when upgrading is not immediately possible.
Disable OSC 52 clipboard write support in terminal emulators used by developers to reduce clipboard hijack risk.

bash

# Upgrade usage_rules to the patched release
mix deps.update usage_rules
# Verify the resolved version is 1.2.8 or later
mix deps | grep usage_rules