CVE-2026-48813: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in david-a-wheeler flawfinder
Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contains ANSI escape sequences can end up being included in flawfinder's standard terminal output, with many effects. Untrusted fields (such as filenames, categories, or code context text) were not properly sanitized when generating structured reports. An attacker could exploit this to corrupt CSV formats or inject arbitrary XML attributes into SonarQube outputs via output_sonar(). It impacts those who use flawfinder to evaluate intentionally malicious filenames or file contents. This issue has been fully patched in Version 2.0.20 (released 2026-05-16). There is no configuration-based workaround within older versions of flawfinder. If an immediate upgrade is not possible, users can mitigate the risk by pre-scanning filenames, inspecting raw output, and/or restricting untrusted inputs.
AI Analysis
Technical Summary
Flawfinder, a static analysis tool for C/C++ code, before version 2.0.20, does not properly sanitize untrusted input fields like filenames, categories, or code context text when generating output. This leads to output manipulation vulnerabilities including Terminal/ANSI Escape Sequence Injection and XML Injection. Malicious filenames containing ANSI escape sequences can alter terminal output, and untrusted fields can corrupt CSV formats or inject arbitrary XML attributes in SonarQube reports via output_sonar(). The issue was fixed in version 2.0.20 released on 2026-05-16.
Potential Impact
An attacker who controls filenames or source text analyzed by flawfinder can manipulate the tool's output, potentially corrupting terminal display and structured report formats such as CSV and XML. This could mislead users or automated systems consuming flawfinder outputs. There is no direct impact on confidentiality, integrity, or availability of flawfinder itself, but the integrity of its output is compromised.
Mitigation Recommendations
A fix is available in flawfinder version 2.0.20. Users should upgrade to this version to fully remediate the issue. There is no configuration-based workaround in older versions. If immediate upgrade is not possible, users can mitigate risk by pre-scanning filenames for malicious escape sequences, carefully inspecting raw output for anomalies, and restricting untrusted inputs to flawfinder.
CVE-2026-48813: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in david-a-wheeler flawfinder
Description
Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contains ANSI escape sequences can end up being included in flawfinder's standard terminal output, with many effects. Untrusted fields (such as filenames, categories, or code context text) were not properly sanitized when generating structured reports. An attacker could exploit this to corrupt CSV formats or inject arbitrary XML attributes into SonarQube outputs via output_sonar(). It impacts those who use flawfinder to evaluate intentionally malicious filenames or file contents. This issue has been fully patched in Version 2.0.20 (released 2026-05-16). There is no configuration-based workaround within older versions of flawfinder. If an immediate upgrade is not possible, users can mitigate the risk by pre-scanning filenames, inspecting raw output, and/or restricting untrusted inputs.
CVSS v4.0
Score 8.7high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Flawfinder, a static analysis tool for C/C++ code, before version 2.0.20, does not properly sanitize untrusted input fields like filenames, categories, or code context text when generating output. This leads to output manipulation vulnerabilities including Terminal/ANSI Escape Sequence Injection and XML Injection. Malicious filenames containing ANSI escape sequences can alter terminal output, and untrusted fields can corrupt CSV formats or inject arbitrary XML attributes in SonarQube reports via output_sonar(). The issue was fixed in version 2.0.20 released on 2026-05-16.
Potential Impact
An attacker who controls filenames or source text analyzed by flawfinder can manipulate the tool's output, potentially corrupting terminal display and structured report formats such as CSV and XML. This could mislead users or automated systems consuming flawfinder outputs. There is no direct impact on confidentiality, integrity, or availability of flawfinder itself, but the integrity of its output is compromised.
Mitigation Recommendations
A fix is available in flawfinder version 2.0.20. Users should upgrade to this version to fully remediate the issue. There is no configuration-based workaround in older versions. If immediate upgrade is not possible, users can mitigate risk by pre-scanning filenames for malicious escape sequences, carefully inspecting raw output for anomalies, and restricting untrusted inputs to flawfinder.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-4c3c-r6p8-c863
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-48813"]
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
Threat ID: 6a3ef76827e9c79719fee7ab
Added to database: 06/26/2026, 22:04:24 UTC
Last enriched: 08/12/2026, 12:53:46 UTC
Last updated: 09/14/2026, 22:01:34 UTC
Views: 129
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.