CVE-2026-82584: CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences in ash-project igniter

The vulnerability arises because the panel builder in Igniter.Project.Deps writes publisher-controlled metadata fields (meta.description, owner usernames, requirement names, version) to the terminal with only newlines stripped, but without sanitizing ANSI escape sequences. A malicious or typosquatted package can exploit this by embedding terminal control sequences that manipulate the display, forging trusted author information and concealing the true metadata. This undermines the anti-typosquatting safeguard intended to help developers vet packages before installation. The issue affects igniter versions from 0.8.1 up to but not including 0.8.4.

An attacker controlling a malicious package can deceive developers by forging the mix igniter.install confirmation prompt, potentially causing the developer to approve and install a malicious dependency. The impact is limited to social engineering and deception during package installation, with no direct code execution or privilege escalation indicated. The CVSS score of 2.3 reflects the low severity and the requirement for user interaction.

No explicit patch or fix is stated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, developers should be cautious when approving packages, especially those from untrusted or typosquatted sources, and consider additional verification methods beyond the confirmation panel.