CVE-2026-72847: Improper Neutralization of Escape, Meta, or Control Sequences in Canop broot
Description
broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain to_string_lossy() call in src/tree_build/builder.rs and in TreeLine::unprune in src/tree/tree_line.rs, and no control-character filtering exists anywhere in the code, even though the doc comment on the TreeLine name field states that some characters may have been stripped. Any local user who can create a file can therefore place an escape sequence in its name and have it written unmodified to the terminal of anyone who browses that directory, between broot's own styling codes. A reported proof of concept used an OSC 52 clipboard-write sequence and captured the raw bytes broot wrote to its pty, confirming the sequence reaches the terminal unstripped. What an injected OSC or CSI sequence can then do depends on the terminal emulator in use. Browsing a directory is broot's primary function and carries no expectation that the content is trusted.
CVSS v4.0
Score 2.4low
Affected software
Canop
broot
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises because broot renders file and directory names exactly as read from the filesystem using to_string_lossy() without filtering control characters or escape sequences. This allows injection of terminal escape sequences such as OSC 52 clipboard-write sequences into the terminal output when browsing directories. The injected sequences are not stripped and reach the terminal unmodified, potentially allowing unintended terminal behavior depending on the terminal emulator. The vulnerability affects broot versions >=0 and <=1.58.0.
Potential Impact
A local user able to create files can embed escape sequences in file or directory names that are rendered unfiltered in the terminal of users browsing those directories. This can lead to unexpected terminal behavior or potential information leakage depending on the terminal emulator's interpretation of the escape sequences. The CVSS score is low (2.4), indicating limited impact and exploitability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious when browsing directories containing files created by untrusted local users. No official fix or workaround is currently documented.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-10T15:14:51.468Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a873babacd9273b49eebb06
Added to database: 08/20/2026, 17:38:51 UTC
Last enriched: 09/25/2026, 02:39:35 UTC
Last updated: 10/05/2026, 06:48:18 UTC
Views: 85
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.