Skip to content
CVE PROGRAM SOURCE RECORD8.0 High

CVE-2026-3108

Terminal Escape Injection in mmctl Report Posts Command

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Mattermost

Description

Mattermost versions 11.2.x <= 11.2.2, 10.11.x <= 10.11.10, 11.4.x <= 11.4.0, 11.3.x <= 11.3.1 fail to sanitize user-controlled post content in the mmctl commands terminal output which allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences that enable screen manipulation, fake prompts, and clipboard hijacking.. Mattermost Advisory ID: MMSA-2026-00599

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mattermost Mattermost

Default version status: unaffected

  • 11.2.0 to ≤ 11.2.2affected
  • 10.11.0 to ≤ 10.11.10affected
  • 11.4.0 to ≤ 11.4.0affected
  • 11.3.0 to ≤ 11.3.1affected
  • 11.5.0unaffected
  • 11.2.3unaffected
  • 10.11.11unaffected
  • 11.4.1unaffected
  • 11.3.2unaffected

References