Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest version and name fields to manipulate terminal output, rewrite window titles, hide text, or trigger emulator-specific behavior when victims run onefetch.
I am monitoring the upstream bug https://github.com/o2sh/onefetch/issues/1828 and the proposed fix in https://github.com/o2sh/onefetch/pull/1829. I am inclined to allow a little more time for discussion to run its course, and ideally for the fix to be at least merged upstream, before applying a downstream patch. Since the proposed fix is in the main onefetch crate, corresponding to the rust-onefetch package, I’m closing bugs filed against rust-onefetch-ascii, rust-onefetch-image, and rust-onefetch-manifest.
*** Bug 2542291 has been marked as a duplicate of this bug. ***
*** Bug 2542293 has been marked as a duplicate of this bug. ***
*** Bug 2542290 has been marked as a duplicate of this bug. ***
FEDORA-EPEL-2026-013960599f (rust-onefetch-2.28.1-4.el10_4) has been submitted as an update to Fedora EPEL 10.4. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-013960599f
FEDORA-EPEL-2026-e54d718960 (rust-onefetch-2.27.1-5.el10_2) has been submitted as an update to Fedora EPEL 10.2. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-e54d718960
FEDORA-EPEL-2026-f0ef1f4b16 (rust-onefetch-2.28.1-4.el9) has been submitted as an update to Fedora EPEL 9. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-f0ef1f4b16
FEDORA-EPEL-2026-f0ef1f4b16 has been pushed to the Fedora EPEL 9 testing repository. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-f0ef1f4b16 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-EPEL-2026-013960599f has been pushed to the Fedora EPEL 10.4 testing repository. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-013960599f See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-EPEL-2026-f2037995cd has been pushed to the Fedora EPEL 10.3 testing repository. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-f2037995cd See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-EPEL-2026-e54d718960 has been pushed to the Fedora EPEL 10.2 testing repository. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-e54d718960 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-EPEL-2026-f0ef1f4b16 (rust-onefetch-2.28.1-4.el9) has been pushed to the Fedora EPEL 9 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-EPEL-2026-f2037995cd (rust-onefetch-2.27.1-10.el10_3) has been pushed to the Fedora EPEL 10.3 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-EPEL-2026-e54d718960 (rust-onefetch-2.27.1-5.el10_2) has been pushed to the Fedora EPEL 10.2 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-EPEL-2026-013960599f (rust-onefetch-2.28.1-4.el10_4) has been pushed to the Fedora EPEL 10.4 stable repository. If problem still persists, please make note of it in this bug report.