{"id":"CVE-2026-54162","kind":"vulnerability","aliases":["CVE-2026-54162"],"related":[],"title":"Ember: terminal escape codes in request URIs spoof the Caddy dashboard","description":"Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row formatters pass Caddy access-log fields, particularly the request URI, through the `fitCellLeft` render helper without neutralizing terminal escape or control sequences. An unauthenticated remote client can place ANSI, OSC, or CSI control bytes in an ordinary HTTP request target. Caddy JSON-escapes those bytes, `ParseLogLine` decodes them back into raw controls, and the formatters concatenate them into `View()` output reaching `os.Stdout`. When the operator views the default `Logs` tab, the terminal interprets these sequences, allowing monitoring-dashboard spoofing, clipboard hijacking through `OSC 52`, and window-title spoofing through `OSC 0/2`. This works even with a loopback-only log listener because the input arrives through normal Caddy access logs. `Certificates` and `Routes` share secondary unneutralized render sinks. The `--json`, `--once`, and daemon `--expose` modes are unaffected because they do not render an interactive terminal. Consequences depend on the terminal emulator and usually require further operator action to escalate; this is not general-purpose remote code execution. This issue is fixed in version 1.4.2.","summary":"Ember is a terminal dashboard for Caddy servers. Before 1.4.2 it prints raw access-log request URIs into the interactive terminal without stripping control sequences, so an unauthenticated remote client can make the operator's terminal show spoofed content, hijack the clipboard via OSC 52, or change the window title.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["caddy","frankenphp","package","self-hosted","terminal"],"not_affected_if":["daemon-expose-only","fixed-1.4.2-or-later","json-or-once-only"],"how_to_check":"- Check the installed Ember version: `ember --version` (unknown if the sources do not give the exact flag)\n- Check whether the interactive dashboard is used on a host that serves Caddy access logs to remote clients","fix":"- Upgrade Ember to `1.4.2` or later\n- Until upgraded, avoid running the interactive TUI against logs carrying untrusted request URIs","status":"open","published_at":"2026-10-28T20:18:00+00:00","first_seen_at":"2026-10-28T20:35:10+00:00","triaged_at":"2026-10-28T20:36:19+00:00","updated_at":"2026-10-28T20:36:19+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T20:36:19Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Ember to `1.4.2` or later\n- Until upgraded, avoid running the interactive TUI against logs carrying untrusted request URIs","reach":"internet","title":"Ember: terminal escape codes in request URIs spoof the Caddy dashboard","impact":"low","summary":"Ember is a terminal dashboard for Caddy servers. Before 1.4.2 it prints raw access-log request URIs into the interactive terminal without stripping control sequences, so an unauthenticated remote client can make the operator's terminal show spoofed content, hijack the clipboard via OSC 52, or change the window title.","category":"package","nicknames":[],"who_cares":["caddy","frankenphp","self-hosted","terminal"],"confidence":0.8,"needs_auth":"no","worst_case":"terminal spoofing, clipboard hijack and window-title change on operator screen","analyst_note":"","how_to_check":"- Check the installed Ember version: `ember --version` (unknown if the sources do not give the exact flag)\n- Check whether the interactive dashboard is used on a host that serves Caddy access logs to remote clients","needs_analyst":false,"not_affected_if":["json-or-once-only","daemon-expose-only","fixed-1.4.2-or-later"],"who_is_affected":"Operators who run the interactive Ember terminal dashboard against Caddy access logs that include internet-supplied request targets. The --json, --once and daemon --expose modes do not render an interactive terminal and are unaffected, so teams that use only those can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000651,"input_tokens":3654,"output_tokens":572,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-54162':14A,17A '0/2':190C '1.4.2':34B,92C,264C '52':70B,182C 'access':39B,100C,208C 'access-log':38B,99C 'action':246C 'allow':173C 'ansi':125C 'arriv':204C 'back':146C 'byte':130C,142C 'caddi':10A,18B,31B,85C,98C,137C,207C 'certif':210C 'chang':72B 'client':55B,122C 'clipboard':67B,178C 'code':4A,256C 'concaten':153C 'consequ':235C 'content':64B 'control':49B,117C,129C,149C 'csi':128C 'cve':12A,15A 'daemon':222C 'dashboard':11A,29B,83C,176C 'decod':144C 'default':165C 'depend':236C 'ember':1A,25B,76C 'emul':240C 'escal':248C 'escap':3A,115C,140C 'even':193C 'execut':257C 'expos':223C 'field':102C 'fitcellleft':109C 'fix':261C 'formatt':96C,152C 'frankenphp':19B,88C 'general':253C 'general-purpos':252C 'helper':111C 'hijack':65B,179C 'host':23B 'http':134C 'input':203C 'interact':45B,93C,233C 'interpret':170C 'issu':259C 'json':139C,219C 'json-escap':138C 'listen':200C 'log':40B,101C,166C,199C,209C 'loopback':197C 'loopback-on':196C 'make':57B 'mode':224C 'monitor':175C 'monitoring-dashboard':174C 'neutral':113C 'normal':206C 'oper':59B,162C,245C 'ordinari':133C 'os.stdout':159C 'osc':69B,126C,181C,189C 'output':157C 'packag':20B 'parseloglin':143C 'particular':103C 'pass':97C 'place':124C 'print':36B 'prior':90C 'purpos':254C 'raw':37B,148C 'reach':158C 'real':80C 'real-tim':79C 'remot':54B,121C,255C 'render':110C,216C,231C 'request':6A,41B,105C,135C 'requir':243C 'rout':212C 'row':95C 'secondari':214C 'self':22B 'self-host':21B 'sequenc':50B,118C,172C 'server':32B,86C 'share':213C 'show':62B 'sink':217C 'spoof':8A,63B,177C,187C 'strip':48B 'support':89C 'tab':167C 'target':136C 'termin':2A,24B,28B,46B,61B,82C,114C,169C,234C,239C 'time':81C 'titl':75B,186C 'tui':94C 'unaffect':226C 'unauthent':53B,120C 'unneutr':215C 'uri':7A,42B,106C 'usual':242C 'version':263C 'via':68B 'view':156C,163C 'window':74B,185C 'window-titl':184C 'without':47B,112C 'work':192C","nicknames":[],"mitigations":[],"who_affected":"Operators who run the interactive Ember terminal dashboard against Caddy access logs that include internet-supplied request targets. The --json, --once and daemon --expose modes do not render an interactive terminal and are unaffected, so teams that use only those can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T20:18:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54162","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54162","severity":null,"published_at":"2026-10-28T20:18:00+00:00","modified_at":"2026-10-28T20:18:00+00:00","first_seen_at":"2026-10-28T20:35:10+00:00","fetched_at":"2026-10-28T20:35:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}