GHSA-8QX3-8GM5-9CJ2: Terminal Escape-Sequence Injection in pickem

Vulnerability ID: GHSA-8QX3-8GM5-9CJ2
CVSS Score: 7.8
Published: 2026-08-25

The npm package 'pickem' is vulnerable to a terminal escape-sequence injection (CWE-150). Unsanitized terminal outputs allow attackers to execute arbitrary shell commands via clipboard hijacking (OSC 52) or manipulate terminal displays through Control Sequence Introducers (CSI).

TL;DR

Unsanitized rendering of user input in the 'pickem' library allows attackers to inject terminal escape sequences, potentially leading to remote code execution through clipboard hijacking (OSC 52).

Technical Details

CWE ID: CWE-150
Attack Vector: Local / Network-Adjacent (via external inputs like branch names or PR titles)
CVSS v3.1 Score: 7.8
EPSS Score: N/A
Exploit Status: Proof of Concept (PoC) available in official unit tests
CISA KEV Status: Not Listed

Affected Systems

CLI tools using the pickem library
Node.js CLI environments with user-supplied prompts

Mitigation Strategies

Upgrade the pickem package to version 1.0.7 or later
Filter user-controllable input strings for non-printable control characters
Disable OSC 52 clipboard write features in terminal emulator configurations if not strictly required

Remediation Steps:

Run 'npm install pickem@latest' to update the local package dependency
Audit CLI applications to verify that rendering inputs are passed through the sanitizeDisplay utility
Employ static code analysis to search for output components that write unsanitized variables to stdout