Executive brief
WeTTY, a web-based terminal emulator, is vulnerable to a security flaw where an attacker can execute malicious commands in a user's terminal session. By tricking the terminal into displaying a specially crafted filename during a file download, an attacker can take control of the user's session, potentially stealing data or running unauthorized commands. This occurs when a user views malicious content, such as a log file or a message from another user, within the WeTTY terminal.
Technical details
WeTTY versions prior to 3.0.4 are vulnerable to DOM-based Cross-Site Scripting (XSS) within the file-download escape sequence handler. The client-side code in `src/client/wetty/download.ts` decodes a base64-encoded filename from a terminal escape sequence (`\x1b[5i...`) and interpolates it directly into a Toastify notification with `escapeMarkup: false`. An attacker can trigger this by causing the victim's terminal to render a malicious escape sequence (e.g., via `cat`ing a file or viewing a log). Once executed, the malicious JavaScript can interact with `window.wetty_term` to read terminal buffers or inject keystrokes into the active PTY session. The issue is fixed in version 3.0.4 by properly escaping the filename before interpolation.
Affected products
- butlerx wetty < 3.0.4
Timeline
- 2026-05-27: disclosed
- 2026-07-01: advisory: GitHub Advisory published
- 2026-07-01: patched: Version 3.0.4 released