broot renders file and directory names exactly as read from the filesystem using to_string_lossy() without filtering control characters. This allows injection of terminal escape sequences (e.g., OSC 52 clipboard-write sequences) into the terminal output when browsing directories. The vulnerability arises because no control-character filtering exists despite documentation suggesting some characters might be stripped. The exploitability depends on the terminal emulator's behavior. The vulnerability affects broot versions <=1.58.0. No official remediation or patch has been documented as of the published date.

Local users who can create files can embed terminal escape sequences in file names, which are then rendered unfiltered to the terminal of users browsing those directories with broot. This can lead to unintended terminal behavior or potential information leakage depending on the terminal emulator. The CVSS score of 2.4 indicates a low severity impact, reflecting limited attack vector and complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when browsing directories containing files created by untrusted users. Consider using terminal emulators with mitigations against malicious escape sequences or avoid using broot to browse untrusted directories.