The vulnerability allows a local user who can create or rename files and directories to embed terminal escape sequences, such as OSC 52 clipboard‑write or other CSI commands, directly into file names. Because broot renders the names in its interactive tree view using a plain to_string_lossy() call without any control‑character filtering, these sequences are sent unmodified to the terminal as the file list is drawn. Depending on the terminal emulator, the injected sequence can alter the clipboard, change terminal settings, or trigger arbitrary terminal actions.

Canop’s broot is the affected product. No explicit version range is documented in the advisory; the concurrency issue exists in the code that builds and displays the tree view.

The CVSS score is 2.4, indicating low severity, and no EPSS data is available. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local: an attacker must have the ability to create or rename files within a directory that a broot session will inspect. While the impact is limited to the terminal session of the user running broot, the ability to inject sequences that modify the clipboard or execute terminal commands can be exploited in environments where terminal output is not trusted. Overall risk is moderate for environments that rely on broot to view untrusted file systems.