A critical terminal injection vulnerability in Mattermost allows authenticated attackers to manipulate administrator terminals through crafted messages.

This vulnerability involves the improper neutralization of ANSI and OSC escape sequences within the mmctl command line tool. An authenticated user can inject these sequences into post content, which, when rendered in an administrator's terminal, allows for arbitrary screen manipulation, deceptive prompts, and potential clipboard hijacking.

The vulnerability carries a CVSS score of 8.0, reflecting its potential for high impact on confidentiality, integrity, and availability within the administrative environment. By hijacking the terminal session of an administrator, an attacker could trick the user into executing unauthorized commands or exfiltrating sensitive data, leading to a compromise of the entire Mattermost platform and its underlying server infrastructure.

Immediate Action: Update Mattermost instances to versions 11.5.0, 11.2.3, 10.11.11, 11.4.1, or 11.3.2 immediately to neutralize the vulnerable terminal output handling.

Proactive Monitoring: Review administrative audit logs for unusual command execution patterns or suspicious post content that may indicate an attempt to inject terminal escape sequences.

Compensating Controls: Restrict the use of the mmctl tool to trusted administrative workstations and ensure that terminal emulators are configured to disable or strictly filter OSC and ANSI escape sequences where possible.

Public Exploit Available: No (exploit_available: unknown)

Given the high severity of this terminal injection flaw, administrators must prioritize patching to the identified secure versions. Failure to update leaves administrative sessions exposed to sophisticated manipulation that can bypass standard security controls by subverting the terminal interface itself.