CVE-2026-72847

Name of the Vulnerable Software and Affected Versions broot (affected versions not specified)

Description broot renders file and directory names in its interactive tree view exactly as they are read from the filesystem without filtering control characters. This occurs during the conversion process using the to string lossy() call within src/tree build/builder.rs and the TreeLine::unprune function in src/tree/tree line.rs. A local user can create a file containing an escape sequence in its name, which is then written unmodified to the terminal of any user browsing that directory. This allows for the injection of OSC (Operating System Command) or CSI (Control Sequence Introducer) sequences, the impact of which depends on the terminal emulator being used. A proof of concept demonstrated the use of an OSC 52 sequence to write to the clipboard.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.