CVE-2026-124992 Details
Description
A vulnerability was identified in nushell up to 0.116.1. Impacted is the function escape_bytes of the file crates/nu-json/src/ser.rs of the component Data Conversion Handler. The manipulation leads to improper neutralization of escape, meta, or control sequences. The attack must be carried out locally. The pull request to fix this issue awaits acceptance.
A vulnerability exists in Nushell versions through 0.116.1 within the Data Conversion Handler component. The issue arises in the 'escape_bytes' function of 'crates/nu-json/src/ser.rs', where there is improper handling of escape, meta, or control sequences. This flaw allows for the injection of unescaped control characters, including escape sequences, into the terminal when certain output commands are used. The vulnerability requires local exploitation.
A patch has been developed and is awaiting acceptance. It extends the 'escape_bytes' function in the 'nu-json' crate to properly escape all control characters, not just those with specific JSON shorthand escapes. The patch has been validated to remove injected escape bytes from all affected output formats.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 9, 2026CISA-ADP
Assessed Nov 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nushell/nushell/ | [email protected] | Vendor |
| https://github.com/nushell/nushell/issues/19197 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/nushell/nushell/pull/19443 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/cve/CVE-2026-124992 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1040563 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/433164 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/433164/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-150 | Improper Neutralization of Escape, Meta, or Control Sequences | [email protected] |
| CWE-20 | Improper Input Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nushell | <= 0.114.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 10, 2026 | CVE Modified | CISA-ADP |
| Nov 9, 2026 | New CVE Received | [email protected] |