CVE-2026-48813

Name of the Vulnerable Software and Affected Versions flawfinder versions prior to 2.0.20

Description Improper input neutralization leads to output manipulation through Terminal/ANSI Escape Sequence Injection and XML Injection. This occurs when the software evaluates malicious filenames or file contents. An attacker can use filenames containing ANSI escape sequences to spoof terminal output, potentially hiding critical scan results from reviewers. Additionally, untrusted fields such as filenames, categories, or code context text are not properly sanitized during the generation of structured reports, allowing for CSV corruption or the injection of arbitrary XML attributes into SonarQube outputs via the output sonar() function.

Recommendations Update to version 2.0.20 or later. Manually or programmatically verify that target repositories do not contain filenames with control characters, including ANSI escape sequences, before processing. Review outputs in a text editor or logging mechanism that displays or strips raw escape sequences instead of using live terminal rendering. Avoid generating SonarQube or CSV reports from completely untrusted repositories.