GNU cpio’s archive listing command outputs member names without adequate escaping, allowing a malicious archive to embed newline or ANSI escape sequences in file names. When a user runs cpio -it, those unfiltered characters appear directly on the terminal, potentially producing forged entries or triggering terminal control sequences. The impact is restricted to the display output, enabling confusion or social‑engineering attacks but not code execution or system compromise. The weakness is classified as CWE-116 and CWE-94.

The issue affects GNU cpio installations that have not incorporated commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30; all releases distributed prior to that fix are vulnerable. The CNA product list includes only GNU:cpio, which applies to the core GNU cpio binaries and associated packages on Linux and Unix‑like systems. No specific version numbers were enumerated, so any cpio binary lacking the commit is considered at risk.

The calculated CVSS score of 4.6 indicates a moderate risk level, while the EPSS score of <1% signals a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widely reported or active exploitation. Because the flaw is local and requires an attacker to run cpio on a crafted archive, the attack vector is typically an insider or a compromised user with shell access. Even though the risk is low, the impact on terminal display could be used for deceptive or disruptive purposes in sensitive environments.