CVE-2026-90773 Details
Description
procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute processes with malicious ANSI or OSC escape sequences in their command line arguments, which are written unmodified to other users' terminals for interpretation by terminal emulators.
A vulnerability exists in the 'procs' process management tool, specifically in versions through 0.14.12. The issue arises because the application fails to properly sanitize escape sequences in process command lines before displaying them. This oversight allows local attackers to inject malicious ANSI or OSC escape sequences into the command line arguments of processes they execute. When another user runs 'procs', these escape sequences are transmitted unaltered to their terminal, where they can be interpreted by the terminal emulator.
Users can update to 'procs' version 0.14.12 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 13, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dalance/procs | [email protected] | ProductVendor |
| https://github.com/dalance/procs/blob/v0.14.12/src/columns/command.rs | [email protected] | Source CodeVendor |
| https://github.com/dalance/procs/commit/a064cec7d59f69a636d38e247824245dcd3a9836 | [email protected] | Source CodeVendor |
| https://github.com/dalance/procs/issues/950 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/procs-through-0.14.12-terminal-escape-sequence-injection-via-command | [email protected] | AdvisoryBundleVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-150 | Improper Neutralization of Escape, Meta, or Control Sequences | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dalance procs | <= 0.14.12 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 13, 2026 | New CVE Received | [email protected] |