npm-check-updates through version 23.0.2 fails to filter terminal escape sequences that can be embedded in a dependency's package.json homepage or repository URL fields. When a developer runs the tool with the --format homepage or --format repo options, these unfiltered escape sequences are written directly to the terminal, permitting an attacker to inject arbitrary terminal control characters. The primary impact is malicious manipulation of terminal output or other terminal‑dependent behavior, which could obscure logs or distract developers. This flaw is identified as CWE‑150, reflecting insufficient validation of escape sequences passed to the terminal.

The vulnerability affects the npm‑check‑updates utility produced by raineorshine, specifically all releases up to and including 23.0.2. Any environment that runs ncu against a dependency with a crafted homepage or repository URL is impacted; users of newer, patched releases are not affected.

The CVSS score of 5.3 indicates a moderate level of severity. The EPSS score is not available, and the issue is not listed in CISA KEV, suggesting current exploitation activity is unknown. Exploitation requires that the attacker can influence the dependency’s package.json (for example, by injecting a malicious package into the registry or modifying an existing one) and that the developer executes ncu with the vulnerable format options. The attack is local to the developer’s terminal and does not provide privilege escalation or remote code execution, but it can lead to deceptive output or side effects that affect security monitoring.