CVE-2020-26283: Control character injection in console output

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-03-24 · updated 2026-06-17
Weakness: CWE-116

Description

go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0, control characters are not escaped from console output. This can result in hiding input from the user which could result in the user taking an unknown, malicious action. This is fixed in version 0.8.0.

Affected products

ipfs go-ipfs: before 0.8.0 — fixed in 0.8.0

How to fix

Upgrade to a fixed version: ipfs go-ipfs 0.8.0. Check the vendor advisory for mitigations.

References

https://github.com/ipfs/go-ipfs/commit/fb0a9acd2d8288bd1028c3219a420de62a09683a
https://github.com/ipfs/go-ipfs/pull/7831
https://github.com/ipfs/go-ipfs/security/advisories/GHSA-r4gv-vj59-cccm
https://github.com/ipfs/go-ipfs/commit/fb0a9acd2d8288bd1028c3219a420de62a09683a
https://github.com/ipfs/go-ipfs/pull/7831
https://github.com/ipfs/go-ipfs/security/advisories/GHSA-r4gv-vj59-cccm

Get alerted when CVE-2020-26283 or the next vulnerability affects your stack