---
id: "CVE-2026-54162"
kind: "vulnerability"
aliases: ["CVE-2026-54162"]
title: "Ember: terminal escape codes in request URIs spoof the Caddy dashboard"
severity: "medium"
cvss: 4.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["caddy", "frankenphp", "package", "self-hosted", "terminal"]
not_affected_if: ["daemon-expose-only", "fixed-1.4.2-or-later", "json-or-once-only"]
published_at: "2026-10-28T20:18:00+00:00"
first_seen_at: "2026-10-28T20:35:10+00:00"
updated_at: "2026-10-28T20:36:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54162", "first_seen_at": "2026-10-28T20:35:10+00:00"}]
---

# Ember: terminal escape codes in request URIs spoof the Caddy dashboard

Ember is a terminal dashboard for Caddy servers. Before 1.4.2 it prints raw access-log request URIs into the interactive terminal without stripping control sequences, so an unauthenticated remote client can make the operator's terminal show spoofed content, hijack the clipboard via OSC 52, or change the window title.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Ember version: `ember --version` (unknown if the sources do not give the exact flag)
- Check whether the interactive dashboard is used on a host that serves Caddy access logs to remote clients

## Fix

- Upgrade Ember to `1.4.2` or later
- Until upgraded, avoid running the interactive TUI against logs carrying untrusted request URIs

## Timeline

- 2026-10-28T20:35:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-54162

## From the sources

Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row formatters pass Caddy access-log fields, particularly the request URI, through the `fitCellLeft` render helper without neutralizing terminal escape or control sequences. An unauthenticated remote client can place ANSI, OSC, or CSI control bytes in an ordinary HTTP request target. Caddy JSON-escapes those bytes, `ParseLogLine` decodes them back into raw controls, and the formatters concatenate them into `View()` output reaching `os.Stdout`. When the operator views the default `Logs` tab, the terminal interprets these sequences, allowing monitoring-dashboard spoofing, clipboard hijacking through `OSC 52`, and window-title spoofing through `OSC 0/2`. This works even with a loopback-only log listener because the input arrives through normal Caddy access logs. `Certificates` and `Routes` share secondary unneutralized render sinks. The `--json`, `--once`, and daemon `--expose` modes are unaffected because they do not render an interactive terminal. Consequences depend on the terminal emulator and usually require further operator action to escalate; this is not general-purpose remote code execution. This issue is fixed in version 1.4.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_