---
id: CVE-2026-54162
title: >-
  Ember: Unneutralised terminal escape/control sequences from Caddy logs
  injected into the operator's TUI
summary: >-
  Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP
  support. Prior to 1.4.2, interactive TUI row formatters pass Caddy access-log
  fields, particularly the request URI, through the `fitCellLeft` render helper
  without…
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-150
vendor: alexandre-daubois
product: ember
affected:
  - ember < 1.4.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-29T18:31:30.695330Z'
published: '2026-10-28'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T18:31:49.122Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-54162'
references:
  - url: >-
      https://github.com/alexandre-daubois/ember/security/advisories/GHSA-x3g7-qrwc-f6c5
    label: >-
      https://github.com/alexandre-daubois/ember/security/advisories/GHSA-x3g7-qrwc-f6c5
  - url: >-
      https://github.com/alexandre-daubois/ember/commit/fcb7160e58dba58d6f9b5033cc312fdedc8c9f6b
    label: >-
      https://github.com/alexandre-daubois/ember/commit/fcb7160e58dba58d6f9b5033cc312fdedc8c9f6b
  - url: 'https://github.com/alexandre-daubois/ember/releases/tag/v1.4.2'
    label: 'https://github.com/alexandre-daubois/ember/releases/tag/v1.4.2'
  - url: 'https://github.com/advisories/GHSA-x3g7-qrwc-f6c5'
tags:
  - cve.org
  - ghsa
  - go
epss: 0.00251
epssPercentile: 0.16477
aliases:
  - GHSA-x3g7-qrwc-f6c5
ecosystem: go
patched:
  - github.com/alexandre-daubois/ember 1.4.2
ingestedAt: '2026-08-20T18:59:55.117Z'
---

## Overview

Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row formatters pass Caddy access-log fields, particularly the request URI, through the `fitCellLeft` render helper without neutralizing terminal escape or control sequences. An unauthenticated remote client can place ANSI, OSC, or CSI control bytes in an ordinary HTTP request target. Caddy JSON-escapes those bytes, `ParseLogLine` decodes them back into raw controls, and the formatters concatenate them into `View()` output reaching `os.Stdout`. When the operator views the default `Logs` tab, the terminal interprets these sequences, allowing monitoring-dashboard spoofing, clipboard hijacking through `OSC 52`, and window-title spoofing through `OSC 0/2`. This works even with a loopback-only log listener because the input arrives through normal Caddy access logs. `Certificates` and `Routes` share secondary unneutralized render sinks. The `--json`, `--once`, and daemon `--expose` modes are unaffected because they do not render an interactive terminal. Consequences depend on the terminal emulator and usually require further operator action to escalate; this is not general-purpose remote code execution. This issue is fixed in version 1.4.2.

## Affected

- `ember < 1.4.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54162)

Affected packages:

- `github.com/alexandre-daubois/ember < 1.4.2`

Patched in:

- `github.com/alexandre-daubois/ember 1.4.2`

Source: https://github.com/advisories/GHSA-x3g7-qrwc-f6c5