colmux in collectl before 4.3.20.2 fails to sanitize ANSI/VT100 escape codes received from remote collectl instances before echoing them to the operator’s terminal. A local user on the monitored host can craft a process name to include these control sequences, causing them to be interpreted by the terminal of a user running colmux. This can alter the display, move the cursor, or otherwise interfere with the operator’s interaction with the interface.

Affected versions are all releases of collectl up to and including 4.3.20.1, which contain the vulnerable colmux component. The issue arises when remote collectl instances send data containing escape sequences that the monitored host’s colmux prints unfiltered. Any Linux system running these versions of collectl is potentially impacted.

The CVSS score of 7.7 indicates a high severity local user vulnerability. The EPSS is not available, but the lack of an entry in the CISA KEV catalog suggests no publicly known exploitation yet. The attack requires local user privileges on a host where collectl runs and the ability to start a process with a crafted argv[0]. After compromising a local account the attacker can inject terminal control codes into the operator’s terminal session, causing confusion or hijacking, but not arbitrary code execution. Nonetheless the potential for disruptive impact is significant, so timely patching is recommended.