Executive brief
pickem is a CLI component library for autocomplete and multi-select pickers. The library fails to sanitize attacker-controllable text (such as git branch names, filenames, or API results) before displaying it in the terminal, allowing malicious control sequences to execute arbitrary actions. An attacker can inject sequences that silently write commands to a user's clipboard, overwrite trusted UI elements to spoof prompts, or trigger other terminal exploits that lead to remote code execution on the next paste.
Technical details
The vulnerability is a terminal escape-sequence injection (CWE-150) affecting pickem versions before 1.0.7. The library renders item text (labels, descriptions, group names, metadata) to the terminal without sanitizing control characters or ANSI escape sequences. The render function chrome.row only partially stripped ANSI codes from the active row, leaving inactive rows, the public createFormatter, and selection-summary lines vulnerable. Since item text is often sourced from untrusted inputs (git branch names, PR titles, filenames, npm/API results), attackers can inject OSC 52 sequences to write to the clipboard, cursor-movement sequences to overwrite trusted output, or C0 control characters to flood and corrupt terminal state. The fix in 1.0.7 introduces a sanitizeDisplay() function that strips all escape sequences except benign SGR (color) codes and removes all C0/C1/DEL control bytes at the render boundary, applied uniformly across all prompts and output paths.
Affected products
- calebogden pickem < 1.0.7
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Fixed in version 1.0.7