Spaceship-prompt vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Spaceship-prompt products: 1 record(s), with severity, exploitation and fixes.

Spaceship-prompt 1

Exploited only (KEV) →

CVE-2026-100867 Low · 3.3 CWE-150 Sep 27, 2026

spaceship-prompt through 4.22.5 Terminal Escape Sequence Injection

spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh prompt. Attackers can embed ANSI/OSC escape sequences in version fields of package manifests to manipulate terminal output, rewrite window titles, or spoof displayed text when victims enter the directory.