CVE-2026-66486

Name of the Vulnerable Software and Affected Versions GNU cpio (affected versions not specified)

Description Improper encoding or escaping of output occurs in the archive member listing functionality. When listing archive members using the cpio -it command, member names are printed directly to the output without quoting or escaping. This allows an attacker to create a cpio archive with member names containing embedded newline characters or ANSI escape sequences, leading to forged listing entries or terminal control sequence injection when the listing is displayed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.