CVE-2026-73035
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
npm-check-updates through 23.0.2 contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with --format homepage or --format repo, unfiltered escape sequences are written to the terminal, enabling malicious output manipulation or other terminal-dependent effects.
Risk Assessment
Risk of terminal manipulation for developers, which could lead to visual deception or execution of malicious commands in the terminal.
Recommendation
Upgrade npm-check-updates to a version after 23.0.2 that includes the fix (commit b554b84). Avoid using --format homepage/repo with untrusted packages.
Original NVD description (English source)
npm-check-updates through 23.0.2, fixed in commit b554b84, contains a terminal escape sequence injection vulnerability that allows an attacker to embed arbitrary terminal control characters in a dependency's package.json homepage or repository URL fields. When a developer runs ncu with the --format homepage or --format repo option, unfiltered escape sequences are written directly to the terminal, enabling malicious output manipulation or other terminal-dependent effects.