~ / search / GHSA-364c-vvqx-446c

GHSA-364c-vvqx-446c

Croc sender may place ANSI or CSI escape sequences in filename to attach receiver's terminal device

Source: GitHub Advisory Database (reviewed) High CVE-2023-43620

Packages

EcosystemPackageAffectedFixed in
Go github.com/schollz/croc/v9 < 9.6.16 9.6.16

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in Croc before 9.6.16. A sender may place ANSI or CSI escape sequences in a filename to attack the terminal device of a receiver.

References

External links from the advisory. They lead to third-party sites.