01 Record

CVE-2026-72847

broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree View

LowPUBLISHEDCNA: VulnCheck

Base score2.4 CVSS v4.0CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

02 Description

broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree View

Published

2026-08-20 17:19Z1 DAY AGO

Last updated

2026-08-21 16:22Z9 HR AGO

Reserved

2026-08-10

Assigning CNA

VulnCheck

Record state

PUBLISHED

Severity

Low (CVSS 2.4)

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Weaknesses

SSVC decision

ExploitationpocAutomatablenoTechnical Impactpartial

Data version

5.2

Document digest

ee5f9a855b208dbf0531926b0628dcf580896e616217786b753b65d2eeb3bc13

VendorProductVersionsPlatforms

Canopbroot0 to 1.58.0—

github.comGitHub Issue #1188https://github.com/Canop/broot/issues/1188issue-tracking
github.comStrip terminal escape sequences from displayed file/directory names (#1189)https://github.com/Canop/broot/commit/4ba40f7d47af78457c7656f15eba71d63d97fce5patch
github.comimprove esc stripping, apply it to link targets toohttps://github.com/Canop/broot/commit/0717a94b3c0efa19c7bbcfe0fb49a2374752a168patch
github.comUnsanitized name handling in TreeLine at v1.58.0https://github.com/Canop/broot/blob/v1.58.0/src/tree/tree_line.rstechnical-description
github.comUnsanitized name construction in the tree builder at v1.58.0https://github.com/Canop/broot/blob/v1.58.0/src/tree_build/builder.rstechnical-description
github.comhttps://github.com/Canop/brootproduct
www.vulncheck.comVulnCheck Advisory: broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree Viewhttps://www.vulncheck.com/advisories/broot-terminal-escape-sequence-injection-via-unsanitized-file-and-directory-names-in-the-tree-viewthird-party-advisory