Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

wetty

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.6npmAmendedPublished

    wetty vulnerable to DOM XSS via file-download filename

    CVE-2026-49864 · GHSA-p26j-h7wj-r568

    Affected
    • npm wetty < 3.0.4
    Fixed in
    3.0.4· Vendor fix available
    Issue
    The wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string (escapeMarkup: false). Any output the victim renders - a cat'd file, a tailed log, an SSH MOTD, a curl response - that contains \x1b5i...:...\x1b[4i runs script in the wetty origin and types attacker-chosen keystrokes into the victim's SSH session. Preconditions - Victim has wetty open with an active SSH session. - Attacker delivers the file-download escape sequence (\x1b[5i<b64-name:<b64-content\x1b[4i) into output the victim's terminal renders. - Default configuration; no non-default flags required. Details Every byte the server forwards from the PTY passes through FileDownloader.buffer. The buffer scans for the documented file-download markers \x1b[5i (begin) and \x1b[4i (end) - documented in docs/downloading-files.md - and, on a complete match, hands the inner payload to onCompleteFile. fileName is base64-decoded from the escape-sequence…

    Recommended action: Upgrade to 3.0.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →