CVE-2026-100866

Name of the Vulnerable Software and Affected Versions onefetch versions prior to 2.28.2

Description The software writes repository information field values to the terminal without removing control characters, which enables terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences—special codes used to control cursor position, color, and other formatting—within the project manifest name and version fields. This allows for the manipulation of terminal output, rewriting of window titles, hiding of text, or triggering of emulator-specific behavior when a user runs the application.

Recommendations Update to version 2.28.2 or later.