CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences
variantThe product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (97)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-31651US | critical9.8 | Exploit | ||
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible
for a specially… | ||||
| CVE-2024-52005US | high8.8 | Exploit | ||
Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the clien… | ||||
| CVE-2017-0899US | critical9.8 | — | ||
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute te… | ||||
| CVE-2022-30123US | critical10.0 | — | ||
A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack. | ||||
| CVE-2025-47284US | critical9.9 | — | ||
Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in the `gardenlet` component of Gardener pri… | ||||
| CVE-2023-3265US | critical9.8 | — | ||
An authentication bypass exists on CyberPower PowerPanel Enterprise by failing to sanitize meta-characters from the username, allowing an attacker to login into the application wit… | ||||
| CVE-2023-26055US | critical9.9 | — | ||
XWiki Commons are technical libraries common to several other top level XWiki projects. Starting in version 3.1-milestone-1, any user can edit their own profile and inject code, wh… | ||||
| CVE-2020-6932US | critical9.8 | — | ||
An information disclosure and remote code execution vulnerability in the slinger web server of the BlackBerry QNX Software Development Platform versions 6.4.0 to 6.6.0 could allow… | ||||
| CVE-2026-25996US | critical9.8 | — | ||
Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. String fields from eBPF events in colu… | ||||
| CVE-2021-25310US | high8.8 | — | ||
The administration web interface on Belkin Linksys WRT160NL 1.0.04.002_US_20130619 devices allows remote authenticated attackers to execute system commands with root privileges via… | ||||
| CVE-2020-26283US | high8.8 | — | ||
go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0, control characters are not escaped f… | ||||
| CVE-2026-3108US | high8.8 | — | ||
Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output wh… | ||||
| CVE-2025-1692US | high8.8 | — | ||
The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text into mongosh that eva… | ||||
| CVE-2024-56201US | high8.8 | — | ||
Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename o… | ||||
| CVE-2023-30844US | high8.8 | — | ||
Mutagen provides real-time file synchronization and flexible network forwarding for developers. Prior to versions 0.16.6 and 0.17.1 in `mutagen` and prior to version 0.17.1 in `mut… | ||||
| CVE-2023-28446US | high8.8 | — | ||
Deno is a simple, modern and secure runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Arbitrary program names without any ANSI filtering allows any malicious… | ||||
| CVE-2023-40185US | high8.6 | — | ||
shescape is simple shell escape library for JavaScript. This may impact users that use Shescape on Windows in a threaded context. The vulnerability can result in Shescape escaping… | ||||
| CVE-2026-54057US | high7.8 | — | ||
Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-control) query reply reflects attacker-controlled bytes, including newlines, into t… | ||||
| CVE-2026-45038US | high7.8 | — | ||
Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.233, since Tabby does not escape control characters from file paths when dragging and dropping a… | ||||
| CVE-2026-41526US | high7.8 | — | ||
In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a shell command. This parsing does not adequately handle metac… | ||||
03
attack patterns (4)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan