AIKIDO-2026-486680

symfony/console is vulnerable to Terminal Escape Sequence Injection

Terminal Escape Sequence Injection Pre-CVE Published 3 days ago

Low Risk

This Affects:

symfony/console

8.1.0 - 8.1.1

Fixed in 8.1.2

Are you affected? Scan for Free

TL;DR

The FileInputHelper writes a selected file's name and path back to the terminal as a hyperlink and only escapes the formatter metacharacters < and >, leaving raw terminal control bytes intact. A file whose name or path contains escape-introducer bytes such as ESC or BEL can therefore smuggle terminal escape sequences into the rendered output, and the same unsanitized paths also reach the terminal through InvalidFileException error messages. When a console command reads such a file through askForFile() or an #[Ask] InputFile argument, the embedded sequences run in the user's terminal, enabling effects like window-title spoofing and clipboard writes. The fix strips C0 and C1 control bytes from the name, path, and MIME type before they are displayed.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your application reads files from users through the console file input feature (for example SymfonyStyle::askForFile() or an #[Ask] InputFile argument) with file names or paths that can be influenced by untrusted input.