CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences, page 2
Filter
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.
What the weakness is: CWE-150 at MITRE
Related attack patterns (CAPEC): 4
- CAPEC-41 Using Meta-characters in E-mail Headers to Inject Malicious Payloads Likelihood: High · Severity: High
- CAPEC-81 Web Server Logs Tampering Likelihood: Medium · Severity: High
- CAPEC-93 Log Injection-Tampering-Forging Likelihood: High · Severity: High
- CAPEC-134 Email Injection Severity: Medium
The attack patterns MITRE's CAPEC relates to CWE-150, as MITRE names them. Credits.
Ask an AI about CWE-150
Show the prompt
Explain CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/150.html and https://cve.bz/cve/cwe/150?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 8.8CVE-2026-3108EPSS 0.3%
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator terminals …
- 5.6CVE-2025-62845EPSS 0.2%
An improper neutralization of escape, meta, or control sequences vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit the vulnerability to cause unexpected behavior. We…
- 6.9CVE-2026-25996EPSS 0.6%
Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. String fields from eBPF events in columns output mode are rendered to the terminal without any sa…
- 7.8CVE-2025-15311EPSS 0.2%
Tanium addressed an unauthorized code execution vulnerability in Tanium Appliance.
- 7.4CVE-2026-21521EPSS 0.6%
Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose information over a network.
- 5.3CVE-2026-23829ExploitEPSS 1.4%
Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit's SMTP server is vulnerable to Header Injection due to an insufficient Regular Expression used to validate `RCPT TO` and `MAIL FROM` addresses. An at…
- 2.0CVE-2026-21439EPSS 0.3%
badkeys is a tool and library for checking cryptographic public keys for known vulnerabilities. In versions 0.0.15 and below, an attacker may inject content with ASCII control characters like vertical tabs, ANSI escape sequences, etc., tha…
- 6.5CVE-2025-65082EPSS 0.9%
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs. …
- 4.6CVE-2025-64494EPSS 0.2%
Soft Serve is a self-hostable Git server for the command line. In versions prior to 0.10.0, there are several places where the user can insert data (e.g. names) and ANSI escape sequences are not being removed, which can then be used, for e…
- 9.6CVE-2025-55754EPSS 10%
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console s…
- 2.3CVE-2025-58160EPSS 0.3%
tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input co…
- 2.7CVE-2025-55193EPSS 0.6%
Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unes…
- 7.5CVE-2024-47252EPSS 0.8%
Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomL…
- 9.9CVE-2025-47284EPSS 0.5%
Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in the `gardenlet` component of Gardener prior to versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0. It c…
- 2.5CVE-2024-58251EPSS 0.2%
In netstat in BusyBox through 1.37.0, local users can launch of network application with an argv[0] containing an ANSI terminal escape sequence, leading to a denial of service (terminal locked up) when netstat is used by a victim.
- 5.4CVE-2025-30089EPSS 0.3%
gurk (aka gurk-rs) through 0.6.3 mishandles ANSI escape sequences.
- 8.8CVE-2025-0975EPSS 0.7%
IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD console could allow an authenticated user to execute code due to improper neutralization of escape characters.
- 6.8CVE-2025-1693EPSS 0.2%
The MongoDB Shell may be susceptible to control character injection where an attacker with control over the database cluster contents can inject control characters into the shell output. This may result in the display of falsified messages…
- 8.8CVE-2025-1692EPSS 0.3%
The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text into mongosh that evaluates arbitrary code. Control characters in the pasted tex…
- 9.8CVE-2025-25286EPSS 1.0%
Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code execution may be possible in web-accessible installations of Homarus in certain c…
- 7.5CVE-2024-52005EPSS 0.5%
Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the client via the so-called "sideband channel". These messages will…
- 2.1CVE-2024-52006EPSS 1.0%
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information b…
- 2.1CVE-2024-50349EPSS 0.7%
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using …
- 6.1CVE-2025-23026EPSS 0.3%
jte (Java Template Engine) is a secure and lightweight template engine for Java and Kotlin. In affected versions Jte HTML templates with `script` tags or script attributes that include a Javascript template string (backticks) are subject t…
- 6.5CVE-2024-9774EPSS 0.7%
A vulnerability was found in python-sql where unary operators do not escape non-Expression.
- 5.4CVE-2024-56201EPSS 0.3%
Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless o…
- 2.5CVE-2024-43785EPSS 0.2%
gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. gitoxide-core, which provides most underlying functionality of the gix and ein commands, does not neutralize newlines, backspaces, or control characters—including th…
- 7.5CVE-2024-36052EPSS 0.7%
RARLAB WinRAR before 7.00, on Windows, allows attackers to spoof the screen output via ANSI escape sequences, a different issue than CVE-2024-33899.
- 9.6CVE-2024-32986EPSS 0.7%
PWAsForFirefox is a tool to install, manage and use Progressive Web Apps (PWAs) in Mozilla Firefox. Due to improper sanitization of web app properties (such as name, description, shortcuts), web apps were able to inject additional lines in…
- 7.1CVE-2024-33899EPSS 0.8%
RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.
- 3.3CVE-2024-28085EPSS 2.2%
wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences …
- 6.5CVE-2024-27936EPSS 0.9%
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Starting in version 1.32.1 and prior to version 1.41.0 of the deno library, maliciously crafted permission request can show the spoofed permission prompt by in…
- 8.6CVE-2023-40185EPSS 0.7%
shescape is simple shell escape library for JavaScript. This may impact users that use Shescape on Windows in a threaded context. The vulnerability can result in Shescape escaping (or quoting) for the wrong shell, thus allowing attackers t…
- 9.8CVE-2023-3265EPSS 1.6%
An authentication bypass exists on CyberPower PowerPanel Enterprise by failing to sanitize meta-characters from the username, allowing an attacker to login into the application with the default user "cyberpower" by appending a non-printabl…
- 3.6CVE-2023-39342EPSS 0.3%
Dangerzone is software for converting potentially dangerous PDFs, office documents, or images to safe PDFs. The Dangerzone CLI (`dangerzone-cli` command) logs output from the container where the file sanitization takes place, to the user's…
- 8.8CVE-2023-30844EPSS 0.7%
Mutagen provides real-time file synchronization and flexible network forwarding for developers. Prior to versions 0.16.6 and 0.17.1 in `mutagen` and prior to version 0.17.1 in `mutagen-compose`, Mutagen `list` and `monitor` commands are su…
- 8.8CVE-2023-28446EPSS 1.1%
Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Arbitrary program names without any ANSI filtering allows any malicious program to clear the first 2 lines of a `op_spawn_child` o…
- 9.9CVE-2023-26055EPSS 1.2%
XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profile and inject code, which is going to be executed with programming right. The sam…
- 10.0CVE-2022-30123EPSS 2.0%
A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack.
- 3.0CVE-2021-25743EPSS 0.8%
kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
- 8.8CVE-2021-25310EPSS 4.7%
The administration web interface on Belkin Linksys WRT160NL 1.0.04.002_US_20130619 devices allows remote authenticated attackers to execute system commands with root privileges via shell metacharacters in the ui_language POST parameter to …
- 9.8CVE-2020-6932EPSS 3.6%
An information disclosure and remote code execution vulnerability in the slinger web server of the BlackBerry QNX Software Development Platform versions 6.4.0 to 6.6.0 could allow an attacker to potentially read arbitrary files and run arb…
- 9.8CVE-2017-0899EPSS 11%
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.