CVE-2026-54162

Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row formatters pass Caddy access-log fields, particularly the request URI, through the `fitCellLeft` render helper without neutralizing terminal escape or control sequences. An unauthenticated remote client can place ANSI, OSC, or CSI control bytes in an ordinary HTTP request target. Caddy JSON-escapes those bytes, `ParseLogLine` decodes them back into raw controls, and the formatters concatenate them into `View()` output reaching `os.Stdout`. When the operator views the default `Logs` tab, the terminal interprets these sequences, allowing monitoring-dashboard spoofing, clipboard hijacking through `OSC 52`, and window-title spoofing through `OSC 0/2`. This works even with a loopback-only log listener because the input arrives through normal Caddy access logs. `Certificates` and `Routes` share secondary unneutralized render sinks. The `--json`, `--once`, and daemon `--expose` modes are unaffected because they do not render an interactive terminal. Consequences depend on the terminal emulator and usually require further operator action to escalate; this is not general-purpose remote code execution. This issue is fixed in version 1.4.2.

• CWE-150

• https://github.com/alexandre-daubois/ember/commit/fcb7160e58dba58d6f9b5033cc312fdedc8c9f6b
• https://github.com/alexandre-daubois/ember/releases/tag/v1.4.2
• https://github.com/alexandre-daubois/ember/security/advisories/GHSA-x3g7-qrwc-f6c5

Published

Oct 28, 2026

Last Modified

Oct 29, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54157LobeHub is a work-and-lifestyle space to find, build, and co…9
• CVE-2026-54158SiYuan is an open-source personal knowledge management syste…9.9
• CVE-2026-54159PrestaShop ps_facetedsearch is a module that adds layered na…10
• CVE-2026-5416Due to the improper neutralization of special elements used …8.8
• CVE-2026-54160Network UPS Tools is a collection of programs which provide …8.2
• CVE-2026-54161Network UPS Tools is a collection of programs which provide …8.1
• CVE-2026-54163secure_headers manages application of security headers with …4.7
• CVE-2026-54164API Platform Core is a system to create hypermedia-driven RE…6.5
• CVE-2026-54165Dobase is an open-source, self-hosted workspace with install…6.4
• CVE-2026-54166Shelf is a platform for tracking physical assets. Prior to v…7.1
• CVE-2026-54167Pipelines-as-Code is a CI/CD system that lets users define T…8.2
• CVE-2026-54168Pipelines-as-Code is a CI/CD system that lets users define T…6.5