CVE-2026-49864

Name of the Vulnerable Software and Affected Versions wetty versions prior to 3.0.4

Description The wetty client improperly handles file-download escape sequences by decoding a base64 filename and interpolating it directly into a Toastify HTML string without escaping. An attacker can deliver a specially crafted escape sequence (x1b[5i...:...x1b[4i) through any output the victim renders in the terminal, such as a file read via cat, a tailed log, an SSH MOTD, or a curl response. This allows the execution of arbitrary JavaScript within the wetty origin, which can be used to read terminal contents or inject attacker-chosen keystrokes into the victim's active SSH session via the window.wetty term.input() function.

Recommendations Update to version 3.0.4. As a temporary mitigation, avoid rendering untrusted files or output in the terminal while using wetty.