CVE-2026-90773: procs Terminal Escape Sequence XSS Flaw

CVE-2026-90773 Overview

CVE-2026-90773 affects procs, a Rust-based replacement for the Unix ps command, in versions through 0.14.12. The tool fails to sanitize ANSI and Operating System Command (OSC) escape sequences in process command lines before rendering them in the Command column. A local attacker can launch a process with malicious escape sequences embedded in its arguments. When another user runs procs, the raw sequences are written to that user's terminal and interpreted by the terminal emulator. The issue is tracked as an Improper Neutralization of Escape, Meta, or Control Sequences weakness [CWE-150].

Critical Impact
Local attackers can inject terminal escape sequences into other users' terminals through crafted process arguments, enabling display spoofing or terminal-emulator-specific attacks.

Affected Products

procs versions up to and including 0.14.12
Systems where multiple users share a host and run procs to inspect processes
Terminal emulators that interpret ANSI/OSC escape sequences from process output

Discovery Timeline

2026-09-13 - CVE-2026-90773 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90773

Vulnerability Analysis

procs reads process command lines from the operating system and prints them in the Command column without filtering control characters. Command-line arguments are fully attacker-controlled on Linux and other Unix systems. Any local user can spawn a process whose argv contains ESC (0x1B), Control Sequence Introducer (CSI), or OSC byte sequences. When another user invokes procs, those bytes travel unmodified through standard output to the reader's terminal emulator. The terminal then interprets the sequences as commands rather than displaying them as text. Depending on the emulator, this can rewrite screen content, change window titles, alter colors, or, in vulnerable emulators, trigger command injection through OSC handlers.

Root Cause

The root cause lives in src/columns/command.rs, which formats the Command column using raw process command-line strings. No neutralization is applied to control characters before writing to the terminal. The fix introduces a sanitize_control_chars helper in src/util.rs that replaces any char::is_control character with a space before rendering.

Attack Vector

Exploitation requires local access with the ability to start a process. The attacker launches a binary or script whose arguments include ESC/CSI/OSC sequences. A second user who runs procs on the same host renders the poisoned Command column and hands control of their terminal to the injected sequences. User interaction is required: the victim must invoke procs.

rust

 use crate::process::ProcessInfo;
+use crate::util::sanitize_control_chars;
 use crate::{column_default, Column};
 use std::cmp;
 use std::collections::HashMap;

Source: GitHub commit a064cec

rust

+/// Replace control characters with spaces.
+///
+/// Process command lines are fully attacker-controlled, so any ESC/CSI/OSC
+/// sequence they contain would otherwise be interpreted by the terminal of
+/// whoever runs procs.
+pub fn sanitize_control_chars(s: &str) -> String {
+    s.replace(|c: char| char::is_control(c), " ")
+}

Source: GitHub commit a064cec — the patch adds a helper that strips control characters before the Command column is rendered.

Detection Methods for CVE-2026-90773

Indicators of Compromise

Processes whose /proc/[pid]/cmdline contains ESC (0x1B), CSI (ESC [), or OSC (ESC ]) byte sequences.
Unexpected changes to terminal state (window title, prompt, cursor position) immediately after running procs.
Presence of procs binaries at version 0.14.12 or earlier on multi-user hosts.

Detection Strategies

Scan running processes for command lines containing bytes below 0x20 other than tab and newline; flag any process where argv contains 0x1B.
Inventory installed procs versions across Linux fleet and correlate with the fixed release commit.
Audit shell histories on shared hosts for invocations of procs following the appearance of suspicious short-lived processes.

Monitoring Recommendations

Alert on execve events where argv values contain control characters, using EDR or eBPF-based process telemetry.
Track package updates for procs on shared bastion hosts, build servers, and developer workstations.
Review terminal multiplexer logs on shared jump hosts for anomalous escape-sequence activity.

How to Mitigate CVE-2026-90773

Immediate Actions Required

Upgrade procs to a release that includes commit a064cec7d59f69a636d38e247824245dcd3a9836 (post-0.14.12).
On multi-user systems, restrict or remove procs until the patched version is deployed.
Advise users to avoid running procs on hosts where untrusted local users can start processes.

Patch Information

The fix is merged in pull request #955 (fix/command-escape-sequences) and lands in commit a064cec7d59f69a636d38e247824245dcd3a9836. The patch adds sanitize_control_chars in src/util.rs and applies it to the Command column in src/columns/command.rs. Details are tracked in procs issue #950 and the Vulncheck advisory.

Workarounds

Pipe procs output through a filter that strips control characters, for example procs | tr -d '\033', until the upgrade lands.
Use ps with explicit format options that do not render raw command lines to the terminal.
Configure terminal emulators to disable OSC handlers that execute actions beyond title changes.

bash

# Filter escape sequences from procs output as an interim workaround
procs | LC_ALL=C sed 's/[[:cntrl:]]/ /g'

# Verify the installed procs version
procs --version