diff-so-fancy fails to sanitize non-ANSI SGR control sequences, allowing malicious carriage return and escape characters to survive in filenames, metadata or file contents; when displayed, these sequences are interpreted by the terminal, enabling output manipulation such as filename spoofing, screen clearing, and clipboard injection, which can mislead users during code review or lead to unintended command execution via clipboard hijacking.

The flaw affects all versions of so-fancy:diff-so-fancy that have not incorporated the fix present in commit 9c81294; no specific version range is disclosed, so any unpatched installation may be vulnerable.

The CVSS score of 4.8 indicates moderate severity, while the EPSS score of less than 1 % implies a very low likelihood of exploitation; the vulnerability is not listed in the CISA KEV catalog. Likely attack requires local use of the diff-so-fancy CLI where the diff is rendered in a terminal that processes escape sequences; although remote code execution is not directly supported, an attacker can manipulate terminal state or hijack clipboard content.