Flawfinder, a static code analysis tool for C/C++, has an improper neutralization issue that allows filenames or source text containing terminal escape sequences or XML control characters to be injected into its output. This can corrupt CSV or XML reports and cause terminal control sequences to execute when the output is displayed, potentially revealing sensitive information, altering UI, or enabling downstream tools to process invalid XML attributes. The vulnerability does not crash the tool but alters its output, making it difficult for users to trust the results of a scan on files that may include malicious names or content.

All installations of flawfinder versions earlier than 2.0.20, regardless of operating system, are vulnerable. The vendor released an official patch in version 2.0.20 on 2026‑05‑16, which resolves the improper neutralization of ANSI escape sequences and XML attributes in structured report generation.

The CVSS score of 8.7 marks it as high severity, yet the EPSS score is less than 1 %, indicating a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker must have the ability to craft a malicious filename or source file and run flawfinder, so active user interaction is required. The impact is confined to the tool’s output and any systems that consume that output, such as SonarQube integrations. While this does not provide remote code execution, the injected sequences can interfere with terminal sessions or corrupt downstream automated tooling.