CVE-2026-90773: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-90773 is a terminal escape sequence injection vulnerability in procs, a modern Rust-based replacement for ps. The flaw affects all versions through 0.14.12 and stems from the tool's failure to sanitize ANSI or OSC escape sequences read from process command lines before rendering them in the Command column. A local attacker with low privileges can spawn a process with malicious escape sequences embedded in its command-line arguments (including argv[0]), which are then passed unmodified to the terminals of other users who run procs. It was disclosed on September 13, 2026, with a CVSS v4 base score of 2.4 (Low) and a CVSS v3.1 base score of 3.2 (Low) (Github Advisory, Feedly).

The root cause is classified as CWE-150 (Improper Neutralization of Escape, Meta, or Control Sequences). In src/columns/command.rs, the Command::add function reads each process's command line from /proc/<pid>/cmdline (world-readable on Linux) and only replaces newline (\n) and tab (\t) characters before display — it does not strip the ESC byte (0x1b) or any ANSI/OSC control sequences. The existing ANSI-aware helper util::ansi_trim_end is used only for measuring the width of procs's own styling codes and does not neutralize attacker-supplied content. Because a process's argv[0] is fully attacker-controlled, any local user can craft a process (e.g., using subprocess.Popen with a custom executable= argument) whose command line embeds a raw OSC 52 clipboard-write sequence or CSI sequence; when another user runs procs, the injected bytes reach their terminal unmodified for interpretation by the terminal emulator (GitHub Issue #950, command.rs source).

Successful exploitation allows a low-privileged local attacker to inject arbitrary terminal escape sequences into the terminals of other users who run procs. Depending on the victim's terminal emulator, this could enable actions such as clipboard manipulation (via OSC 52), screen clearing or overwriting (via CSI sequences), or other terminal emulator-specific behaviors. There is no direct confidentiality or availability impact; the primary risk is integrity tampering of the victim's terminal session and potentially the data displayed or stored in their clipboard (Github Advisory, GitHub Issue #950).

No public proof-of-concept exploit code has been released, and there is no evidence of active in-the-wild exploitation as of the disclosure date. The reporter (carfeii) validated the issue against v0.14.12 using a benign OSC 52 clipboard-write payload to confirm unstripped output, but withheld a full PoC. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access and low privileges, and a victim user must run procs while the attacker's crafted process is active (Feedly, GitHub Issue #950).

1. Craft a malicious process: As a low-privileged local user, spawn a background process with a crafted argv[0] containing a raw terminal escape sequence. For example, use Python: subprocess.Popen(args=["\x1b]52;c;bWFya2Vy\x07sleep", "60"], executable="/bin/sleep"). This runs /bin/sleep 60 but sets argv[0] to a string containing an OSC 52 clipboard-write sequence.
2. Wait for victim: The attacker's process remains running and visible in /proc/<pid>/cmdline, which is world-readable on Linux regardless of process ownership.
3. Victim runs procs: When another user (e.g., a system administrator) runs procs to inspect running processes, procs reads the attacker's process's command line and renders it in the Command column without stripping the ESC byte.
4. Escape sequence executes: The raw OSC/CSI bytes are written to the victim's terminal output stream. The victim's terminal emulator interprets the sequence — for example, OSC 52 can overwrite the clipboard with attacker-controlled content, or CSI sequences can clear/overwrite screen content.
5. Impact realized: The specific effect depends on the victim's terminal emulator capabilities and configuration; more aggressive payloads (e.g., terminal title manipulation, hyperlink injection, or screen content modification) are possible within the bounds of what the emulator supports (GitHub Issue #950, Github Advisory).

• Process: Presence of running processes with non-printable or ESC (0x1b) bytes in their argv[0] or command-line arguments, detectable via cat -v /proc/<pid>/cmdline or strings /proc/<pid>/cmdline.
• Logs: Unusual or garbled terminal output in shell history or terminal session recordings when procs was run; clipboard contents unexpectedly changed after running procs.
• File System: No file-system artifacts are expected from this vulnerability alone, as the attack is entirely in-memory and terminal-based.

The fix was merged in commit a064cec (PR #955), which introduces a sanitize_control_chars() function in src/util.rs that replaces all control characters (including ESC/0x1b) with spaces before display in the Command column. Users should upgrade procs to any version after 0.14.12 that includes this patch. As a temporary workaround until patching is possible, restrict terminal access to trusted users only, and consider disabling escape sequence interpretation in terminal emulator settings if supported (GitHub Commit, Github Advisory).