Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-54162— Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUI

Quick assessment

Affected
alexandre-daubois ember
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Ember 是一个支持 FrankenPHP 的 Caddy 服务器实时终端仪表盘。在 1.4.2 版本之前，交互式 TUI（文本用户界面）的行格式化程序会将 Caddy 访问日志字段（尤其是请求 URI）传递给 渲染辅助函数，且未对终端转义序列或控制序列进行中和处理。未认证的远程客户端可以在普通 HTTP 请求的目标（request target）中插入 ANSI、OSC 或 CSI 控制字节。Caddy 会对这些字节进行 JSON 转义，而 函数会将其解码回原始控制序列，随后格式化程序将这些序列拼接至 的输出中

CVSS 4.7 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54162

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUI
Source: CVE Program / CVE List V5
Vulnerability Description
Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row formatters pass Caddy access-log fields, particularly the request URI, through the `fitCellLeft` render helper without neutralizing terminal escape or control sequences. An unauthenticated remote client can place ANSI, OSC, or CSI control bytes in an ordinary HTTP request target. Caddy JSON-escapes those bytes, `ParseLogLine` decodes them back into raw controls, and the formatters concatenate them into `View()` output reaching `os.Stdout`. When the operator views the default `Logs` tab, the terminal interprets these sequences, allowing monitoring-dashboard spoofing, clipboard hijacking through `OSC 52`, and window-title spoofing through `OSC 0/2`. This works even with a loopback-only log listener because the input arrives through normal Caddy access logs. `Certificates` and `Routes` share secondary unneutralized render sinks. The `--json`, `--once`, and daemon `--expose` modes are unaffected because they do not render an interactive terminal. Consequences depend on the terminal emulator and usually require further operator action to escalate; this is not general-purpose remote code execution. This issue is fixed in version 1.4.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
转义、元或控制序列转义处理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
alexandre-daubois ember < 1.4.2 -

II. Public POCs for CVE-2026-54162

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54162

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54162 (1)

Vendor Advisories for CVE-2026-54162 (1)

Vendor Pages for CVE-2026-54162 (1)

IV. Related Vulnerabilities

Same weakness: CWE-150