CVE-2026-73035

Name of the Vulnerable Software and Affected Versions npm-check-updates versions prior to 23.0.3

Description An issue exists where an attacker can embed arbitrary terminal control characters within the homepage or repository URL fields of a dependency's package.json file. When a developer executes the ncu command using the --format homepage or --format repo options, these unfiltered escape sequences are written directly to the terminal. This can lead to malicious output manipulation or other terminal-dependent effects.

Recommendations Update npm-check-updates to version 23.0.3 or later.