{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-82710",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-82710",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-09-08T00:23:36.912Z",
    "updatedAt": "2026-09-08T14:45:23.177Z",
    "importedAt": "2026-10-24T01:58:30.346Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata",
      "summary": "Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project usage_rules allows a malicious package publisher to inject terminal control sequences into the output of mix usage_rules.search_docs.\n\nmix usage_rules.search_docs searches Hex documentation through search.hexdocs.pm, which indexes the documentation of every published package, and prints the matching results (title, package, type, doc reference, and highlighted snippets) to the terminal. The formatter in Mix.Tasks.UsageRules.SearchDocs interpolated those publisher-controlled fields verbatim, neutralizing no terminal control characters; the only transform it applied adds escape sequences rather than removing them. A malicious package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns, OSC 52 clipboard writes) in its indexed documentation, so when a developer runs a search that surfaces those docs the sequences reach the terminal unchanged — forging the displayed hexdocs URL or a suggested command, hiding text, or writing to the clipboard. No authentication or privileged position is required; only publishing a package.\n\nThis issue affects usage_rules: from 0.1.18 before 1.2.8.",
      "affected": [
        {
          "vendor": "ash-project",
          "product": "usage_rules",
          "packageName": "usage_rules",
          "collectionURL": "https://repo.hex.pm",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0.1.18",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "1.2.8"
            }
          ]
        },
        {
          "vendor": "ash-project",
          "product": "usage_rules",
          "packageName": "ash-project/usage_rules",
          "collectionURL": "https://github.com",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "2da7a99536041d63ec1f391d019565789a59595f",
              "status": "affected",
              "versionType": "git",
              "lessThan": "3b8ebb4117d3272bbd436e6c2432113ba6685dbb"
            }
          ]
        }
      ]
    }
  }
}