charmbracelet — Vulnerabilities & Security Advisories 12

Charmbracelet is a Go-based command-line tool for building interactive CLI applications with features like prompts, spinners, and progress bars. Historically, it has been susceptible to multiple remote code execution vulnerabilities due to unsafe input handling in interactive components, cross-site scripting flaws in terminal output rendering, and privilege escalation through improper access controls. The project maintains 12 CVE records, with several critical RCE issues stemming from unsanitized user input in prompt handlers and insecure terminal escape sequence processing. While no major public security incidents have been documented, the consistent pattern of input validation vulnerabilities suggests developers should implement strict sanitization when using user-provided data in charmbracelet's interactive features.