CVE-2026-48813

HIGH

Flawfinder output manipulation via untrusted filenames and source text

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-48813 has a selected CVSS score of 8.7 (high); EIP currently links 1 repository PoC.

Description

Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifically, Terminal/ANSI Escape Sequence Injection and XML Injection. A malicious file whose name contains ANSI escape sequences can end up being included in flawfinder's standard terminal output, with many effects. Untrusted fields (such as filenames, categories, or code context text) were not properly sanitized when generating structured reports. An attacker could exploit this to corrupt CSV formats or inject arbitrary XML attributes into SonarQube outputs via output_sonar(). It impacts those who use flawfinder to evaluate intentionally malicious filenames or file contents. This issue has been fully patched in Version 2.0.20 (released 2026-05-16). There is no configuration-based workaround within older versions of flawfinder. If an immediate upgrade is not possible, users can mitigate the risk by pre-scanning filenames, inspecting raw output, and/or restricting untrusted inputs.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 12, 2026 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

flawfinder

Browse david-a-wheeler / flawfinder
CVE List< 2.0.20affected

flawfinder

Browse PyPI / flawfinder
GitHub AdvisoryBefore 2.0.20 · Fixed in 2.0.20affected

Proofs of concept

1

Repository PoCs

GitHub7alen7/CVE-2026-48813-POCRepository PoCby 7alen70Exploit2 files

3.3 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A bash script that creates a directory containing a C file with a maliciously crafted filename. The filename includes ANSI escape sequences designed to overwrite terminal output when flawfinder scans the directory, hiding genuine vulnerability findings and displaying a forged 'no security issues found' message.

Backdoor review

No backdoor observed in reviewed code

The artifact is a proof-of-concept (PoC) for CVE-2026-48813, demonstrating how attacker-controlled filenames containing terminal escape sequences can visually deceive a developer running flawfinder. The supplied text files (POC.sh and README.md) describe and implement a benign demonstration: they create a file with a crafted name that, when flawfinder scans it, causes the terminal to display a forged 'no security issues found' message, hiding the real flawfinder output. The PoC does not execute any backdoor, install persistence, exfiltrate data, or deliver a malicious payload. The README explicitly states the PoC is for visual deception only and that no code execution occurs. The shell script is transparent and performs only file creation and informational echo statements. No concealed, obfuscated, or operator-directed harmful behavior is present.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagesbash
Target softwareflawfinder
Attack typesterminal escape injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively constructs a malicious artifact (a filename with escape sequences) and a vulnerable C file, then instructs the user to execute flawfinder to trigger the injection. This constitutes an exploit because it exercises the vulnerability to produce a deceptive output, not merely detecting or reporting it.

POC.sh:2POC.sh:35POC.sh:55

Requirements

  • The victim must run flawfinder in a directory containing the attacker-crafted filename.POC.sh:5-6
  • The victim's terminal must interpret ANSI escape sequences (e.g., libvte-based).README.md:2

Observed behavior

  • Creates a file with a name containing ANSI escape sequences (ESC, CR, BEL) that clear the line, move the cursor, and print a forged success message.POC.sh:24-35
  • Writes C code with a known vulnerability (strcpy buffer overflow) into the maliciously-named file.POC.sh:41-47
  • Instructs the user to run flawfinder on the crafted directory, which will display the forged output instead of the real findings.POC.sh:55
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Terminal Escape Sequence Injection
ESC[0mCRESC[2KESC[32m[OK] flawfinder: no security issues foundESC[0mESC[8mThe PoC constructs a filename containing ANSI escape sequences to overwrite terminal output and display a forged message, demonstrating the claimed vulnerability.POC.sh:35
Review boundaries

What the analysis did not establish

  • The evidence does not include the output of executing the script or flawfinder; the described behavior is based solely on the script's code and documentation.
  • The README references images that are not included in the text evidence, so the visual walkthrough cannot be verified.
  • No binary files were present for analysis.
  • The review is limited to the supplied text; the actual behavior of flawfinder or the terminal when processing the crafted filename is not observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

4