Executive brief
diff-so-fancy is a tool used to make code changes (diffs) easier for developers to read. A vulnerability exists where the tool fails to properly clean up special hidden characters in file names or content before displaying them in a user's terminal. An attacker could use this to trick a developer during a code review by spoofing filenames or potentially hijacking the user's clipboard to execute unintended commands.
Technical details
A vulnerability classified as Improper Encoding or Escaping of Output (CWE-116) exists in diff-so-fancy through version 1.4.10. The application only strips ANSI SGR sequences but allows other control characters, such as carriage returns (\r) and escape sequences (OSC, CSI), to pass through to the terminal unsanitized. An attacker can exploit this by embedding malicious sequences in filenames or diff metadata. When a user views these diffs, the terminal may execute these sequences, leading to terminal state alteration, filename spoofing, or clipboard hijacking. The issue has been addressed in commit 9c81294.
Affected products
- so-fancy diff-so-fancy <= 1.4.10
Timeline
- 2026-07-29: advisory: NVD publication date
- 2026-07-29: patched: Fix identified in commit 9c81294