The flaw in onefetch allows control characters to flow unfiltered into the terminal during display of repository metadata. Injection of ANSI or OSC escape sequences can change window titles, hide or reveal text, or invoke emulator‑specific actions. Although it does not provide code execution, the altered output may deceive users or obscure log messages, potentially facilitating social‑engineering attacks. The weakness maps to CWE‑150, reflecting improper handling of control characters.

The vulnerability affects the onefetch tool from the o2sh:onefetch vendor, specifically all releases up to and including version 2.28.1. Users who run this version on any operating system that interprets terminal escape sequences are at risk.

The CVSS score of 4.8 indicates moderate severity. The EPSS score is not available, so current exploitation probability is unknown. The issue is not listed in CISA’s KEV catalog. The likely attack vector is local; an attacker must control the repository metadata shown by onefetch and may require the victim to run the tool in a terminal that interprets escape sequences. With that context, the risk is primarily in UI manipulation rather than privilege escalation or data loss.