CVE-2026-81856

A flaw was found in hex. A remote attacker can inject unescaped terminal control sequences into the output of package manager commands by publishing a package with crafted metadata or serving hostile repository responses. When a user inspects package details, searches for packages, or views error messages, these raw control sequences are rendered directly by the terminal. This flaw can allow attackers to spoof displayed commands and URLs, obscure terminal output, or alter clipboard contents.

This vulnerability is assessed with a Moderate impact because exploitation depends on interactive user queries against untrusted package registries and cannot automatically achieve remote code execution without further developer action. In Red Hat environments, Hex is utilized during development and build processes rather than running as an exposed background daemon. While maliciously formatted metadata or error messages can visually deceive developers or manipulate the clipboard in certain terminal emulators, the issue remains restricted to the local command-line session processing third-party packages.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.