Ember, a real‑time terminal dashboard for Caddy, failed to neutralize terminal escape and control sequences present in Caddy access logs. An unauthenticated external client can embed ANSI, OSC, or CSI bytes into an HTTP request target. Caddy escapes these bytes into JSON, then Ember decodes them and renders them to stdout. The terminal emulator interprets the injected sequences, enabling the attacker to spoof the monitoring dashboard, hijack the clipboard via OSC 52, or spoof the window title using OSC 0/2. The vulnerability does not provide generic remote code execution but can lead to UI manipulation and information leakage if the operator interacts with the output.

Ember products from the alexandre-daubois vendor, specifically all releases prior to version 1.4.2.

The CVSS score of 4.7 classifies this issue as low severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating limited evidence of exploitation in the wild. The attack requires an unauthenticated remote client to send a crafted HTTP request, and the attacker must have an operator view the affected Logs tab; thus the likelihood of successful exploitation is low but still notable in environments where operators access the dashboard with full terminal privileges.