Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-150 (转义、元或控制序列转义处理不恰当) — Vulnerability Class 38

38 vulnerabilities classified as CWE-150 (转义、元或控制序列转义处理不恰当). AI Chinese analysis included.

CWE-150 represents a critical input validation weakness where software fails to properly sanitize special characters before passing data to a downstream component. This flaw typically allows attackers to inject malicious escape, meta, or control sequences, such as HTML tags or SQL commands, which the receiving system interprets as executable instructions rather than literal text. Exploitation often leads to severe consequences like cross-site scripting, command injection, or data corruption, depending on the context of the downstream processor. To mitigate this risk, developers must implement rigorous input validation and output encoding strategies. By strictly neutralizing potentially dangerous characters through context-aware encoding techniques, such as HTML entity encoding or parameterized queries, developers ensure that user-supplied data remains inert, thereby preventing the unintended execution of injected payloads within the application environment.

MITRE CWE Description
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.
Common Consequences (1)
IntegrityExecute Unauthorized Code or Commands, Hide Activities, Unexpected State
ANSI escape codes can be used for low-severity attacks such as changing the color of console output, but they can also be used to arbitrarily move the cursor, clear the screen, and make fake prompts inside the interactive CLI via malicious user input. In some …
Mitigations (5)
Developers should anticipate that escape, meta and control characters/sequences will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
ImplementationAssume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
ImplementationWhile it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments. The most conservative approach is to escape or filter all characters that do not pass an extremely strict allowlist (such as everything that is not alphanumeric or whit…
ImplementationInputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
ImplementationWhen using output from an LLM, neutralize or strip escape codes before redirecting output to the terminal or other rendering engine that would process the codes. The neutralization could require that the character be printable and/or allowable whitespace, such as a carriage return or newline. Be deliberate about wh…
Effectiveness: High
Examples (1)
Consider a situation in which an AI agent uses LLM output based on training data from untrusted sources.
CVE IDTitleCVSSSeverityPublished
CVE-2023-39342 Dangerzone CLI does not sanitize ANSI escape characters — dangerzone 3.6 Low2023-08-08
CVE-2023-30844 Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints — mutagen 3.0 Low2023-05-08
CVE-2023-28446 Deno is vulnerable to interactive `run` permission prompt spoofing via improper ANSI neutralization — deno 8.8 High2023-03-24
CVE-2023-26055 XWiki Commons may allow privilege escalation to programming rights via user's first name — xwiki-commons 10.0 Critical2023-03-02
CVE-2022-30123 RubyGem Rack 安全漏洞 — https://github.com/rack/rack 10.0 -2022-12-05
CVE-2021-25743 ANSI escape characters in kubectl output are not being filtered — Kubernetes 3.0 Low2022-01-07
CVE-2020-6932 BlackBerry QNX Software Development Platform 输入验证错误漏洞 — QNX Software Development Platform (SDP) 10.0 Critical2020-08-12
CVE-2017-0899 RubyGems 安全漏洞 — RubyGems 9.8 -2017-08-31

Vulnerabilities classified as CWE-150 (转义、元或控制序列转义处理不恰当) represent 38 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.