{"id":"CVE-2026-54162","title":"Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUI","summary":"Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row formatters pass Caddy access-log fields, particularly the request URI, through the `fitCellLeft` render helper without…","severity":"medium","cvss":4.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-150"],"vendor":"alexandre-daubois","product":"ember","affected":["ember < 1.4.2"],"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T19:44:41.999Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-54162","references":[{"url":"https://github.com/alexandre-daubois/ember/security/advisories/GHSA-x3g7-qrwc-f6c5","label":"https://github.com/alexandre-daubois/ember/security/advisories/GHSA-x3g7-qrwc-f6c5"},{"url":"https://github.com/alexandre-daubois/ember/commit/fcb7160e58dba58d6f9b5033cc312fdedc8c9f6b","label":"https://github.com/alexandre-daubois/ember/commit/fcb7160e58dba58d6f9b5033cc312fdedc8c9f6b"},{"url":"https://github.com/alexandre-daubois/ember/releases/tag/v1.4.2","label":"https://github.com/alexandre-daubois/ember/releases/tag/v1.4.2"},{"url":"https://github.com/advisories/GHSA-x3g7-qrwc-f6c5"}],"tags":["cve.org","ghsa","go"],"epss":0.00251,"epssPercentile":0.16454,"aliases":["GHSA-x3g7-qrwc-f6c5"],"ecosystem":"go","patched":["github.com/alexandre-daubois/ember 1.4.2"],"ingestedAt":"2026-08-20T18:59:55.117Z","slug":"CVE-2026-54162","body":"## Overview\n\nEmber is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row formatters pass Caddy access-log fields, particularly the request URI, through the `fitCellLeft` render helper without neutralizing terminal escape or control sequences. An unauthenticated remote client can place ANSI, OSC, or CSI control bytes in an ordinary HTTP request target. Caddy JSON-escapes those bytes, `ParseLogLine` decodes them back into raw controls, and the formatters concatenate them into `View()` output reaching `os.Stdout`. When the operator views the default `Logs` tab, the terminal interprets these sequences, allowing monitoring-dashboard spoofing, clipboard hijacking through `OSC 52`, and window-title spoofing through `OSC 0/2`. This works even with a loopback-only log listener because the input arrives through normal Caddy access logs. `Certificates` and `Routes` share secondary unneutralized render sinks. The `--json`, `--once`, and daemon `--expose` modes are unaffected because they do not render an interactive terminal. Consequences depend on the terminal emulator and usually require further operator action to escalate; this is not general-purpose remote code execution. This issue is fixed in version 1.4.2.\n\n## Affected\n\n- `ember < 1.4.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-54162)\n\nAffected packages:\n\n- `github.com/alexandre-daubois/ember < 1.4.2`\n\nPatched in:\n\n- `github.com/alexandre-daubois/ember 1.4.2`\n\nSource: https://github.com/advisories/GHSA-x3g7-qrwc-f6c5","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":25.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}