CVE-2026-73035 affects the npm-check-updates tool by raineorshine, specifically versions up to and including 23.0.2. The vulnerability arises from improper neutralization of escape, meta, or control sequences in the homepage or repository URL fields of a dependency's package.json. When the ncu command is executed with the --format homepage or --format repo options, the tool writes these unfiltered escape sequences directly to the terminal, enabling an attacker to inject arbitrary terminal control characters. This can lead to malicious output manipulation or other terminal-dependent effects. The issue was fixed in a commit identified as b554b84, but no explicit patch version is provided in the data.

An attacker who can influence the homepage or repository URL fields in a dependency's package.json can inject terminal escape sequences that are rendered when a developer runs npm-check-updates with certain formatting options. This may allow manipulation of terminal output, potentially misleading the user or causing unexpected terminal behavior. The CVSS 4.0 score is 5.3 (medium severity), indicating a moderate risk without requiring privileges or authentication, but user interaction is needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability was fixed in commit b554b84, so upgrading to a version including this commit is recommended once available. Until then, avoid using the --format homepage or --format repo options with untrusted dependencies to reduce exposure.