CVE-2026-100867 spaceship-prompt CVE debrief

Who should care

Defenders responsible for maintaining and securing systems using spaceship-prompt should assess exposure and verify updates to prevent potential terminal output manipulation and other security risks associated with the vulnerability. They should review project manifest version fields for suspicious activity and monitor terminal output for signs of exploitation. Additionally, defenders should prioritize verifying and updating spaceship-prompt to address the

Why it matters

Defenders should care about CVE-2026-100867 as it allows attackers to manipulate terminal output, potentially leading to spoofed displayed text or rewritten window titles, and requires verification and updates to spaceship-prompt.

• Potential terminal output manipulation
• Possible window title rewriting
• Spoofed displayed text when victims enter the directory

Technical summary

The spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh prompt. This allows attackers to embed ANSI/OSC escape sequences to manipulate terminal output, rewrite window titles, or spoof displayed text when victims enter the directory. Defenders should prioritize verifying and updating spaceship-prompt to address potential terminal output manipulation and review project manifest version fields for suspicious activity. The vulnerability requires verification and updates to spaceship-prompt to prevent potential security risks.

Defensive priority

Defenders should prioritize verifying and updating spaceship-prompt to address potential terminal output manipulation.

Recommended defensive actions

• Verify and update spaceship-prompt to the latest version
• Review and sanitize project manifest version fields
• Monitor terminal output for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source references indicate that spaceship-prompt through 4.22.5 is vulnerable to terminal output manipulation via ANSI/OSC escape sequences in package manifest version fields. Defenders should verify and update spaceship-prompt to address potential terminal output manipulation and review project manifest version fields for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.