onefetch versions up to 2.28.1 improperly neutralize escape, meta, or control sequences in repository information fields. Specifically, the tool writes these fields directly to the terminal without removing ANSI/OSC escape sequences. An attacker can embed such sequences in project manifest version and name fields, enabling terminal escape sequence injection. This can lead to manipulation of terminal output such as rewriting window titles, hiding text, or triggering emulator-specific behaviors.

The vulnerability allows an attacker to inject terminal escape sequences that can manipulate the victim's terminal display when onefetch is executed. This could be used to alter terminal output, obscure information, or cause unexpected terminal emulator behavior. There is no indication of privilege escalation or remote code execution. The CVSS score is 4.8 (medium severity), reflecting limited impact and requiring user interaction.

No official patch or fix is currently referenced. Users should exercise caution when running onefetch on repositories with untrusted or potentially malicious manifest data. Monitor vendor advisories for updates or patches addressing this issue. Avoid running onefetch in sensitive environments until a fix is available.