My Rust TUI Let Any Local User Write to My Terminal

Description and use

Any local user can inject terminal escape sequences via process names, command lines, or journal messages, causing unintended terminal actions. Version 0.3.0 sanitizes all output and handles non‑UTF‑8 names to prevent this.

Problem

Any local user can inject terminal escape sequences into tuxctl’s output by setting a process name, command line, or journal message containing control characters, causing unintended terminal actions such as clipboard writes or resets.

Outcome

The vulnerability allowed local users to inject terminal escape sequences via process names, command lines, or journal messages. The fix sanitizes all output and handles non‑UTF‑8 names, preventing unintended terminal actions.

Workflow

• Identify that process names, command lines, and journal messages can contain arbitrary bytes.
• Observe that Ratatui removes only newlines, so ESC bytes reach the terminal.
• Realize that any local user can set a process name via prctl or a command line, or write a journal message with logger.
• Run a demo script that sets a process name to an escape sequence that changes the terminal title.
• Perform a security review of v0.3.0, discovering the bug and a second bug where non‑UTF‑8 names were dropped.
• Implement sanitization of all drawn text and lossless reading of /proc/<pid>/stat.
• Release v0.3.0 with the fixes and no new dependencies.
• Provide a checklist for TUI/CLI developers to avoid similar issues.
• Advise users to upgrade to v0.3.0 or later.

Evidence

any local user could make tuxctl write arbitrary bytes to my terminal

Source

When Ratatui renders a span, it removes newline characters and nothing else.

Source

v0.3.0 now removes control characters and bidirectional overrides from everything tuxctl draws.

Source

For the second bug, /proc/<pid>/stat is now read lossily.

Source