CVE-2026-72847

broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain to_string_lossy() call in src/tree_build/builder.rs and in TreeLine::unprune in src/tree/tree_line.rs, and no control-character filtering exists anywhere in the code, even though the doc comment on the TreeLine name field states that some characters may have been stripped. Any local user who can create a file can therefore place an escape sequence in its name and have it written unmodified to the terminal of anyone who browses that directory, between broot's own styling codes. A reported proof of concept used an OSC 52 clipboard-write sequence and captured the raw bytes broot wrote to its pty, confirming the sequence reaches the terminal unstripped. What an injected OSC or CSI sequence can then do depends on the terminal emulator in use. Browsing a directory is broot's primary function and carries no expectation that the content is trusted.

• CWE-150

• https://github.com/Canop/broot
• https://github.com/Canop/broot/blob/v1.58.0/src/tree/tree_line.rs
• https://github.com/Canop/broot/blob/v1.58.0/src/tree_build/builder.rs
• https://github.com/Canop/broot/commit/0717a94b3c0efa19c7bbcfe0fb49a2374752a168
• https://github.com/Canop/broot/commit/4ba40f7d47af78457c7656f15eba71d63d97fce5
• https://github.com/Canop/broot/issues/1188
• https://www.vulncheck.com/advisories/broot-terminal-escape-sequence-injection-via-unsanitized-file-and-directory-names-in-the-tree-view
• https://github.com/Canop/broot/issues/1188

Published

Aug 20, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-72841luci-app-openvpn fails to properly validate the instance_nam…9.9
• CVE-2026-72842luci-app-lxc contains an ACL inconsistency vulnerability tha…9.9
• CVE-2026-72843The customer update route in EverShop is declared with "acce…9.8
• CVE-2026-72844The Lean 4 kernel does not verify that the structure named i…6.3
• CVE-2026-72845Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-72846Lightdash stores the webhook URL supplied with a scheduled d…6.4
• CVE-2026-72848SitemapLoader.parse_sitemap in langchain_community/document_…8.6
• CVE-2026-72849Budibase before 3.40.0 contains a cross-site request forgery…7.7
• CVE-2026-72850Budibase before 3.40.0 fails to properly sanitize S3 object …9.1
• CVE-2026-72851Budibase before 3.40.0 contains an unauthenticated SQL injec…10
• CVE-2026-72852hank-ai/darknet sizes a convolutional layer's weight and out…7.8
• CVE-2026-72853Budibase before 3.40.0 contains a SQL injection vulnerabilit…7.6