This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-103431 →

DEBIAN-CVE-2026-103431

colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displ...

Original description

The description as published by the source.

colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displaying it, allowing a local user on a monitored host to inject escape sequences into the terminal of an operator running colmux, via a crafted process name (argv[0]).

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 collectl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 collectl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 collectl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

advisory security-tracker.debian.org