AIKIDO-2026-486680

symfony/console is vulnerable to Terminal Escape Sequence Injection

Pre-CVE Published Aug 4, 2026

CVE Score

Low

Terminal Escape Sequence Injection

TL;DR

The FileInputHelper writes a selected file's name and path back to the terminal as a hyperlink and only escapes the formatter metacharacters < and >, leaving raw terminal control bytes intact. A file whose name or path contains escape-introducer bytes such as ESC or BEL can therefore smuggle terminal escape sequences into the rendered output, and the same unsanitized paths also reach the terminal through InvalidFileException error messages. When a console command reads such a file through askForFile() or an #[Ask] InputFile argument, the embedded sequences run in the user's terminal, enabling effects like window-title spoofing and clipboard writes. The fix strips C0 and C1 control bytes from the name, path, and MIME type before they are displayed.

How do I fix this?

Upgrade the symfony/console and/or the symfony/symfony library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application reads files from users through the console file input feature (for example SymfonyStyle::askForFile() or an #[Ask] InputFile argument) with file names or paths that can be influenced by untrusted input.