Description
procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute processes with malicious ANSI or OSC escape sequences in their command line arguments, which are written unmodified to other users' terminals for interpretation by terminal emulators.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dalance | procs | ≤ 0.14.12 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-procs | No fix yet | — |
| Debian 13 | rust-procs | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | rust-procs | No fix yet | — |
| Ubuntu 26.04 LTS | rust-procs | No fix yet | — |
References
- GitHub Issue #950 issue-tracking
- https://github.com/dalance/procs product
- https://github.com/dalance/procs/blob/v0.14.12/src/columns/command.rs technical-description
- https://github.com/dalance/procs/commit/a064cec7d59f69a636d38e247824245dcd3a9836 patch
- VulnCheck Advisory: procs through 0.14.12 Terminal Escape Sequence Injection via Command third-party-advisory