Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata (CVE-2026-82584) | HOL Guard CVE

Unknown severity · Source severity not reportedCVE-2026-82584

Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata

Answer in brief

CVE-2026-82584 records a Unknown severity vulnerability in Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata. The current sources do not mark it as known exploited. The current feed maps ash-project/igniter (generic), ash-project/igniter (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 7, 2026Updated Sep 7, 2026Source checked Sep 8, 2026First seen by HOL Sep 7, 2026Material review Sep 7, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps ash-project/igniter (generic), ash-project/igniter (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
ash-project/ignitergeneric	>=0.8.1 <0.8.4	0.8.4
ash-project/ignitergeneric	>=d26d9b3a8348661813617606076315075d32663b <d492b1aa33f8fb0dacc0afa41b703fb922d42816	d492b1aa33f8fb0dacc0afa41b703fb922d42816

Recommended response

Check inventory. Check lockfiles and deployed manifests for ash-project/igniter, ash-project/igniter.
Review the reported fix. Update ash-project/igniter to 0.8.4; ash-project/igniter to d492b1aa33f8fb0dacc0afa41b703fb922d42816 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 7, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 7, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 7, 2026

Sources and claim methodology

Upstream source description

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel (an anti-typosquatting safeguard) listing a package's hex metadata before adding it. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields (meta.description, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency. This issue affects igniter: from 0.8.1 before 0.8.4.

Quoted source text, attributed separately from HOL analysis.