AIKIDO-2026-736406
npm-check-updates is vulnerable to Terminal Escape Sequence Injection
43
Medium Risk
This Affects:
npm-check-updatesTL;DR
The tool prints package and npm registry metadata such as homepage URLs, repository URLs, error text, peer dependency ranges, and the engines.node value directly to the terminal. When run with the --format homepage or --format repo option, these fields are emitted without stripping ANSI escape or other terminal control sequences. A package whose homepage or repository field embeds crafted control sequences can overwrite rendered lines, hide output, or trigger other terminal-dependent effects when a developer inspects it. The fix adds a sanitizeForDisplay helper that removes VT control characters and bare control characters before the values are displayed.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run the tool with the --format homepage or --format repo option against packages whose homepage or repository metadata can carry untrusted values.
Background info
npm-check-updates is vulnerable to Terminal Escape Sequence Injection in versions 17.0.0 - 23.0.2.
How to fix this
Upgrade the npm-check-updates library to the patch version.
Links
Related Issue
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant