CVE-2026-82584 Details
Description
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel (an anti-typosquatting safeguard) listing a package's hex metadata before adding it. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields (meta.description, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency. This issue affects igniter: from 0.8.1 before 0.8.4.
A vulnerability allowing terminal escape sequence injection has been identified in the Ash Project Igniter package, specifically in versions 0.8.1 prior to 0.8.4. This issue arises from improper neutralization of publisher-controlled metadata in the 'mix igniter.install' confirmation prompt, which serves as an anti-typosquatting safeguard. Malicious package publishers can embed ANSI escape sequences to manipulate the displayed information, forging trusted author names and download counts while obscuring the actual data. As a result, developers may be misled into approving harmful dependencies.
Users can update to Igniter version 0.8.4, where this vulnerability has been patched by removing control characters from all publisher-controlled metadata before it is displayed in the confirmation panel.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 7, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-82584.html | EEF | AdvisoryBundle |
| https://github.com/ash-project/igniter/commit/d492b1aa33f8fb0dacc0afa41b703fb922d42816 | EEF | Source CodeVendor |
| https://github.com/ash-project/igniter/security/advisories/GHSA-cj7w-j579-gc42 | EEF | AdvisoryRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-82584 | EEF | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-150 | Improper Neutralization of Escape, Meta, or Control Sequences | EEF |
Affected Products
| Product | Versions |
|---|---|
| ash-project igniter | >= 0.8.1, < 0.8.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 7, 2026 | New CVE Received | EEF |