Re: zsh can output non-printable characters to the terminal in some error messages

On Wed, Jun 10, 2026 at 6:25 PM Mikael Magnusson <[email protected]> wrote:
>
> On Wed, Jun 10, 2026 at 12:11 PM Vincent Lefevre <[email protected]> wrote:
> >
> > zsh 5.9.1 and below can output non-printable characters to the terminal
> > (such as escape sequences) in some error messages.
> >
> > This may be a security vulnerability if a user creates a file name with
> > malicious escape sequences in it.
> >
> > qaa% file=file$'\033'\[H$'\033'\[c$'\n'$'\b'
> > qaa% touch $file
> > qaa% chmod 0 $file
>
> These two steps are not needed, you'll simply get a "No such file"
> error instead with the same consequences without them.
>
> > The following one is fine:
> >
> > qaa% : < $file
> > zsh: permission denied: file^[[H^[[c\n^H
> >
> > But create a test.zsh script with
> >
> > foo=$(<$1)
> >
> > Then the following command outputs the escapes to the terminal
> > due to the "Permission denied" error:
> >
> > qaa% ./test.zsh $file
> >
> > (to be run in an xterm-compatible terminal).
>
> A slightly friendlier PoC:
> % file=$'\033[35mhello\033[0m'
> % =( chmod +x /dev/stdout; echo 'foo=$(<$1)' ) $file
> /tmp/zsh0Q4Ap1: 1: cannot open hello: No such file
> where "hello" will be listed in purple unexpectedly (presumably).

Hmm, did you make the same mistake I did there? Eg, we didn't include
the #!/bin/zsh shebang. My script was run with /bin/sh and I suspect
so was yours?
% =( chmod +x /dev/stdout; echo '#!/bin/zsh';echo 'foo=$(ls < $1)' ) $file
/tmp/zshp8LCt1:2: no such file or directory: ^[[35mhello^[[0m
% =( chmod +x /dev/stdout; echo '#!/usr/local/bin/zsh-5.0.7';echo
'foo=$(ls < $1)' ) $file
/tmp/zshvOhDLY:2: no such file or directory: ^[[35mhello^[[0m


-- 
Mikael Magnusson