Mattermost Server versions prior to 11.5.0, 11.2.3, 10.11.11, 11.4.1, and 11.3.2 do not escape ANSI and OSC codes that users can embed in post content. When the server outputs this content in the mmctl terminal, the stray escape sequences are interpreted by the terminal, causing screen manipulation, fake prompts, or clipboard hijacking.

The issue affects Mattermost Server 11.2.x up to 11.2.2, 10.11.x up to 10.11.10, 11.4.x up to 11.4.0, and 11.3.x up to 11.3.1. Upgrading to 11.5.0, 11.2.3, 10.11.11, 11.4.1, 11.3.2 or newer resolves the problem.

The CVSS score of 8.0 indicates high severity, while the EPSS score of less than 1 % suggests that exploitation is currently infrequent. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker posting crafted content that includes escape sequences and an administrator later executing an mmctl terminal command that displays that content, which then allows the injected sequences to act on the terminal.