{"id":"CVE-2026-103431","published":"2026-10-01T09:17:07.717","lastModified":"2026-10-01T16:17:36.177","description":"colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displaying it, allowing a local user on a monitored host to inject escape sequences into the terminal of an operator running colmux, via a crafted process name (argv[0]).","cvssScore":7.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","cwes":["CWE-150"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-103431","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2543974","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw in colmux in collectl before 4.3.20.2 allows a local user to inject escape sequences into the terminal of an operator, potentially leading to unauthorized control of the terminal session.","exploitability":"Exploitation requires local access to the monitored host and a crafted process name, making it moderately difficult.","blast_radius":"If exploited, the impact is limited to the terminal session of the operator, potentially allowing for unauthorized terminal control.","remediation":"Upgrade to collectl 4.3.20.2 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["local-priv-escalation","terminal-injection","escape-sequence"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-09T08:45:17.015Z"}}