Medium, CVSS 4.7GoAmendedPublished
Ember has unneutralized terminal escape/control sequences from Caddy logs injected into the operator's TUI
CVE-2026-54162 · GHSA-x3g7-qrwc-f6c5
- Affected
- Go github.com/alexandre-daubois/ember < 1.4.2
- Fixed in
- 1.4.2· Vendor fix available
- Issue
- Ember's interactive TUI renders fields taken from the monitored Caddy server's access logs — most notably the request URI — straight to the operator's terminal without neutralising terminal escape or control sequences (CWE-150). Those log fields are populated from arbitrary, unauthenticated HTTP requests, so any remote client can embed ANSI/OSC/CSI control bytes that the operator's terminal emulator interprets when the log row is displayed. The bytes survive the whole pipeline: Caddy escapes them into its JSON access log as unicode escapes, ember's ParseLogLine decodes them back to raw 0x1b/0x07 bytes, and the row formatters concatenate them into the bubbletea View() output with no encoding before they reach os.Stdout. Impact An unauthenticated, remote attacker who can send HTTP requests to the Caddy server that ember monitors can inject terminal escape sequences into the operator's TUI. The trigger is a single ordinary HTTP request with control bytes in the request target.…
Recommended action: Upgrade to 1.4.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.