Executive brief
procs is a command-line process viewer used to display running processes on Unix-like systems. Versions through 0.14.12 fail to sanitize ANSI and OSC escape sequences in process command-line arguments before displaying them in the Command column, allowing a local attacker to inject malicious escape codes that execute when viewed on other users' terminals, potentially enabling terminal hijacking or data theft.
Technical details
This is an escape sequence injection vulnerability in the Command column rendering logic. The vulnerable code reads process command-line arguments and displays them directly without sanitizing or escaping ANSI control sequences (such as cursor movement, color changes) or Operating System Command (OSC) sequences (which can change terminal title, copy to clipboard, or execute other terminal-specific operations). An attacker can create or run a process with specially crafted escape sequences in its argv, which are written unmodified to other users' terminal output when they run procs. Terminal emulators interpret these sequences, allowing the attacker to manipulate the victim's terminal state or, in some cases, execute arbitrary operations. The attack requires local access to create processes on the target system, and the victim must view the process list in procs. Patches are expected in versions after 0.14.12.
Affected products
- dalance procs through 0.14.12
Timeline
- 2026-09-13: disclosed