CVE-2026-54162

Name of the Vulnerable Software and Affected Versions Ember (affected versions not specified)

Description An unauthenticated remote attacker can inject terminal escape sequences into the operator's terminal user interface (TUI) by sending HTTP requests with control bytes in the request target to a monitored Caddy server. The issue occurs because the ParseLogLine function decodes JSON access logs back into raw bytes, which are then rendered via the fitCellLeft helper and row formatters without neutralizing terminal escape or control sequences. This allows the injection of ANSI, OSC, or CSI control bytes that the terminal emulator interprets. Potential impacts include monitoring-dashboard spoofing through cursor and scroll sequences, clipboard hijacking via OSC 52, and window-title spoofing via OSC 0/2. The Certificates and Routes tabs are also affected. Modes using --json, --once, or --expose are not impacted as they do not render to an interactive terminal.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.