Executive brief
The ash-project igniter tool displays a confirmation panel before installing Elixir package dependencies, designed to prevent accidental installation of malicious or typosquatted packages. A vulnerability allows malicious package publishers to embed terminal control sequences in package metadata, which can overwrite the displayed panel to forge author names and download counts, deceiving developers into approving malicious dependencies.
Technical details
This is an improper neutralization of escape, meta, or control sequences vulnerability (CWE-150) in the Igniter.Project.Deps module. The vulnerability exists in the confirmation panel builder that processes package metadata from the Hex package repository. Publisher-controlled fields such as meta.description, owner usernames, requirement names, and versions are written to the terminal with only newlines stripped, failing to sanitize ANSI escape sequences. An attacker can inject cursor movement, line erase, and carriage return sequences to overwrite trusted content on the terminal display. The attack requires no authentication and succeeds when a developer runs mix igniter.install and reviews the confirmation panel. A malicious package publisher or typosquatter can exploit this to forge the panel without the developer's knowledge.
Affected products
- ash-project igniter 0.8.1 before 0.8.4
Timeline
- 2026-09-07: disclosed