https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 23:34:50 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-354754 EUVD-2026-354754 https://cve.radiocsirt.org/vuln/euvd-2026-354754 https://cve.radiocsirt.org/vuln/fkie_cve-2026-49864 <p>wetty provides terminal access in browser over http/https. Prior to version 3.0.4, the wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string (`escapeMarkup: false`). Any output the victim renders - a `cat`&#39;d file, a tailed log, an SSH MOTD, a `curl` response - that contains `\x1b[5i...:...\x1b[4i` runs script in the wetty origin and types attacker-chosen keystrokes into the victim&#39;s SSH session. Version 3.0.4 fixes the issue.</p> <p>wetty provides terminal access in browser over http/https. Prior to version 3.0.4, the wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string (`escapeMarkup: false`). Any output the victim renders - a `cat`&#39;d file, a tailed log, an SSH MOTD, a `curl` response - that contains `\x1b[5i...:...\x1b[4i` runs script in the wetty origin and types attacker-chosen keystrokes into the victim&#39;s SSH session. Version 3.0.4 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-49864 https://cve.radiocsirt.org/vuln/ghsa-p26j-h7wj-r568 <p><strong>Affected:</strong> npm: wetty</p> <p>### Summary</p> <p>The wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string (`escapeMarkup: false`). Any output the victim renders - a `cat`&#39;d file, a tailed log, an SSH MOTD, a `curl` response - that contains `\x1b[5i...:...\x1b[4i` runs script in the wetty origin and types attacker-chosen keystrokes into the victim&#39;s SSH session.</p> <p>### Preconditions</p> <p>- Victim has wetty open with an active SSH session. - Attacker delivers the file-download escape sequence (`\x1b[5i&lt;b64-name&gt;:&lt;b64-content&gt;\x1b[4i`) into output the victim&#39;s terminal renders. - Default configuration; no non-default flags required.</p> <p>### Details</p> <p>```typescript // src/client/wetty.ts:37, 46-62 const fileDownloader = new FileDownloader(); // ... socket.on(&#39;data&#39;, (data: string) =&gt; { const remainingData = fileDownloader.buffer(data); // every PTY byte forwarded by the server passes through buffer() // ... }) ```</p> <p>Every byte the server forwards from the PTY passes through `FileDownloader.buffer`. The buffer scans for the documented file-download markers `\x1b[5i` (begin) and `\x1b[4i` (end) - documented in `docs/downloading-files.md` - and, on a complete match, hands the inner payload to `onCompleteFile`.</p> <p>```typescript // src/client/wetty/download.ts:9-77 function onCompleteFile(bufferCharacters: string): void { let fileNameBase64; let fileCharacters = bufferCharacters; if (bufferCharacters.includes(&#39;:&#39;)) { [fileNameBase64, fileCh…</p> <p><strong>Affected:</strong> npm: wetty</p> <p>### Summary</p> <p>The wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string (`escapeMarkup: false`). Any output the victim renders - a `cat`&#39;d file, a tailed log, an SSH MOTD, a `curl` response - that contains `\x1b[5i...:...\x1b[4i` runs script in the wetty origin and types attacker-chosen keystrokes into the victim&#39;s SSH session.</p> <p>### Preconditions</p> <p>- Victim has wetty open with an active SSH session. - Attacker delivers the file-download escape sequence (`\x1b[5i&lt;b64-name&gt;:&lt;b64-content&gt;\x1b[4i`) into output the victim&#39;s terminal renders. - Default configuration; no non-default flags required.</p> <p>### Details</p> <p>```typescript // src/client/wetty.ts:37, 46-62 const fileDownloader = new FileDownloader(); // ... socket.on(&#39;data&#39;, (data: string) =&gt; { const remainingData = fileDownloader.buffer(data); // every PTY byte forwarded by the server passes through buffer() // ... }) ```</p> <p>Every byte the server forwards from the PTY passes through `FileDownloader.buffer`. The buffer scans for the documented file-download markers `\x1b[5i` (begin) and `\x1b[4i` (end) - documented in `docs/downloading-files.md` - and, on a complete match, hands the inner payload to `onCompleteFile`.</p> <p>```typescript // src/client/wetty/download.ts:9-77 function onCompleteFile(bufferCharacters: string): void { let fileNameBase64; let fileCharacters = bufferCharacters; if (bufferCharacters.includes(&#39;:&#39;)) { [fileNameBase64, fileCh…</p> https://cve.radiocsirt.org/vuln/ghsa-p26j-h7wj-r568