Executive brief
broot is a popular directory tree browser that displays filenames exactly as stored on the filesystem without filtering control characters or escape sequences. An attacker who can create files can embed terminal escape sequences (like OSC 52 clipboard-write commands) in filenames, which broot will render unfiltered to the terminals of users browsing those directories. Depending on the terminal emulator, this could allow unauthorized clipboard manipulation, terminal control, or other malicious actions.
Technical details
The vulnerability is a terminal escape sequence injection flaw in broot's filename rendering. The affected code in src/tree_build/builder.rs and src/tree/tree_line.rs uses a plain to_string_lossy() call to convert filesystem names to strings without any control-character filtering, despite the documentation claiming some characters may be stripped. An attacker with local filesystem access can create files with embedded ANSI escape sequences (CSI or OSC codes) in their names. When a user browses that directory, broot renders the filenames unfiltered directly to the terminal between its own styling codes, allowing the escape sequences to be interpreted by the terminal emulator. Attack vector is local (requires filesystem write access) and no authentication is required. Proof-of-concept demonstrations have confirmed OSC 52 sequences reach the terminal unmodified, with terminal-dependent impacts ranging from clipboard manipulation to terminal state changes.
Affected products
- Canop broot <1.58.0
Timeline
- 2026-08-20: disclosed