CVE-2026-82710: CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences in ash-project usage_rules

The vulnerability arises because the formatter in Mix.Tasks.UsageRules.SearchDocs interpolates publisher-controlled fields verbatim without neutralizing terminal control characters. Instead of removing escape sequences, it adds escape sequences, allowing malicious packages to embed ANSI terminal escape sequences such as cursor movement, line erase, carriage returns, and OSC 52 clipboard writes in their indexed documentation. When a developer runs a search that surfaces these malicious docs, the escape sequences are rendered unchanged in the terminal, enabling manipulation of the terminal display or clipboard. This affects usage_rules versions from 0.1.18 before 1.2.8.

A malicious package publisher can cause terminal output to be manipulated when developers run documentation searches, potentially forging URLs, hiding or altering displayed text, or writing arbitrary data to the clipboard. This could mislead users or cause unintended clipboard content changes. No authentication or privileged access is required, only the ability to publish a package. The CVSS score is low (2.3), reflecting limited impact and required user interaction.

No official patch or remediation level is provided in the advisory. Users should upgrade to usage_rules version 1.2.8 or later once available, as the vulnerability affects versions before 1.2.8. Until then, be cautious when running mix usage_rules.search_docs commands that display documentation from untrusted or unknown package sources. Monitor vendor advisories for updates and patches.