Re: zsh can output non-printable characters to the terminal in some error messages

[Mikael Magnusson <mikachu@xxxxxxxxx>]

On Wed, Jun 10, 2026 at 12:11 PM Vincent Lefevre <vincent@xxxxxxxxxx> wrote:
>
> zsh 5.9.1 and below can output non-printable characters to the terminal
> (such as escape sequences) in some error messages.
>
> This may be a security vulnerability if a user creates a file name with
> malicious escape sequences in it.
>
> qaa% file=file$'\033'\[H$'\033'\[c$'\n'$'\b'
> qaa% touch $file
> qaa% chmod 0 $file

These two steps are not needed, you'll simply get a "No such file"
error instead with the same consequences without them.

> The following one is fine:
>
> qaa% : < $file
> zsh: permission denied: file^[[H^[[c\n^H
>
> But create a test.zsh script with
>
> foo=$(<$1)
>
> Then the following command outputs the escapes to the terminal
> due to the "Permission denied" error:
>
> qaa% ./test.zsh $file
>
> (to be run in an xterm-compatible terminal).

A slightly friendlier PoC:
% file=$'\033[35mhello\033[0m'
% =( chmod +x /dev/stdout; echo 'foo=$(<$1)' ) $file
/tmp/zsh0Q4Ap1: 1: cannot open hello: No such file
where "hello" will be listed in purple unexpectedly (presumably).

-- 
Mikael Magnusson