Junglewise Threat Intelligence

CVE-2026-54162: Ember terminal escape sequence injection from Caddy logs

CVE-2026-54162 · Severity: medium · CVSS 4.7 · Published 2026-08-20

Executive brief

Ember is a real-time terminal dashboard for monitoring Caddy web servers. The tool displays access logs in its user interface but fails to sanitize terminal control sequences embedded in the logs. An attacker can send crafted HTTP requests to the Caddy server with escape codes in the request URL, which are then reflected through the logs to the operator's terminal. This allows the attacker to manipulate the display (hiding or forging log entries), copy malicious text to the operator's clipboard, or spoof window titles for social engineering—without needing any authentication.

Technical details

This is a CWE-150 vulnerability—improper neutralization of escape, meta, or control sequences. The vulnerability chain: (1) unauthenticated HTTP requests reach Caddy, (2) Caddy logs the request URI as JSON with unicode-escaped control bytes, (3) Ember's `ParseLogLine` function decodes the JSON, restoring raw `0x1b` and `0x07` bytes, (4) the `fitCellLeft` row formatter concatenates these unencoded bytes into the TUI output via bubbletea's `View()` method, and (5) the bytes reach `os.Stdout` and are interpreted by the terminal emulator. The attack requires only network access to the Caddy server and user interaction (viewing the Logs tab, which is the default mode). Demonstrated impacts include CSI sequence injection to forge/hide log rows, OSC 52 clipboard hijacking, and OSC 0/2 window-title spoofing. The Certificates and Routes tabs are also affected. The `--json`, `--once`, and `--expose` modes are not vulnerable because they do not render to an interactive terminal. Patched in version 1.4.2.

Affected products

  • Alexandre Daubois Ember < 1.4.2

Timeline

  • 2026-06-22: disclosed
  • 2026-08-20: advisory: GitHub Advisory Database published
  • 2026-08-20: patched: Fixed in version 1.4.2

References