Executive brief
Flawfinder, a tool used to scan source code for security weaknesses, is vulnerable to output manipulation when processing malicious files. An attacker can craft filenames or source code containing special characters that trick the tool into hiding security alerts or corrupting generated reports. This could lead a human reviewer to believe a codebase is secure when it actually contains critical vulnerabilities.
Technical details
Flawfinder versions prior to 2.0.20 fail to neutralize special elements in its output, leading to Terminal/ANSI Escape Sequence Injection and XML/CSV Injection (CWE-74). A local attacker can craft malicious filenames or source code containing ANSI escape sequences that, when rendered in a terminal, can hide or spoof scan results. Additionally, the tool fails to sanitize fields like filenames and code context when generating structured reports, allowing for the injection of arbitrary XML attributes in SonarQube outputs or corruption of CSV formats. The vulnerability is addressed in version 2.0.20.
Affected products
- David A. Wheeler flawfinder < 2.0.20
Timeline
- 2026-05-16: patched: Version 2.0.20 released
- 2026-05-23: disclosed: Initial disclosure date
- 2026-06-26: advisory: GitHub Advisory published/reviewed