local-it/mitgliederverwaltung

Fork 0

chore(deps): update dependency igniter to v0.8.4 [security] - autoclosed #577

Closed

renovate wants to merge 1 commit from renovate/hex-igniter-vulnerability into main

renovate commented

2026-10-08 14:23:30 +02:00

Collaborator

This PR contains the following updates:

Package	Type	Update	Change
igniter (source)	dev	patch	`0.8.2` → `0.8.4`

Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata

CVE-2026-82584 / EEF-CVE-2026-82584 / GHSA-cj7w-j579-gc42

More information

Details

Summary

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt.

mix igniter.install prints a confirmation panel (an anti-typosquatting safeguard) listing a package's hex metadata before adding it. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields (meta.description, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency.

This issue affects igniter: from 0.8.1 before 0.8.4.

Configurations

Reachable only when a developer runs mix igniter.install against an untrusted or misspelled package name in a terminal emulator that interprets ANSI escape sequences.

Severity

CVSS Score: 2.3 / 10 (Low)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by OSV.

Release Notes

ash-project/igniter (igniter)

`v0.8.4`

Compare Source

Bug Fixes:

strip terminal control sequences from hex install confirmation metadata (CVE-2026-82584) by Zach Daniel
restore application env exactly after evaluating project config (#400) by neilberkman
Control rerunning installers for existing packages (#399) by mvanhorn
unbreak mix igniter.upgrade --git-ci, and positional args after flags (#397) by James Harton
stop boolean flags consuming the following positional arg by James Harton
don't require a package list for igniter.upgrade --git-ci by James Harton

`v0.8.3`

Compare Source

Bug Fixes:

ensure verbose is passed all the way down by Zach Daniel
properly check igniter.rms in --check by Zach Daniel
resolve Elixir 1.20 type-check warnings (#387) by Gilbert

Improvements:

add Igniter.Libs.Phoenix.web_module_for_router/2 (#393) by James Harton
update to Elixir 1.20 (#391) by ESmithByui
direct users to format command for unless refactor by Zach Daniel

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [igniter](https://hex.pm/packages/igniter) ([source](https://github.com/ash-project/igniter)) | dev | patch | `0.8.2` → `0.8.4` | --- ### Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata [CVE-2026-82584](https://nvd.nist.gov/vuln/detail/CVE-2026-82584) / EEF-CVE-2026-82584 / [GHSA-cj7w-j579-gc42](https://github.com/advisories/GHSA-cj7w-j579-gc42) <details> <summary>More information</summary> #### Details ##### Summary Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the `mix igniter.install` confirmation prompt. `mix igniter.install` prints a confirmation panel (an anti-typosquatting safeguard) listing a package's hex metadata before adding it. The panel builder in `Igniter.Project.Deps` wrote publisher-controlled fields (`meta.description`, owner usernames, requirement names, version) to the terminal with only newlines stripped. A malicious or typosquatted package can embed ANSI terminal escape sequences (cursor movement, line erase, carriage returns) in its metadata to overwrite the panel, forging trusted author names and download counts while concealing the real ones, so a developer relying on the panel to vet the package is deceived into approving a malicious dependency. This issue affects igniter: from 0.8.1 before 0.8.4. ##### Configurations Reachable only when a developer runs `mix igniter.install` against an untrusted or misspelled package name in a terminal emulator that interprets ANSI escape sequences. #### Severity - CVSS Score: 2.3 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N` #### References - [https://github.com/ash-project/igniter/security/advisories/GHSA-cj7w-j579-gc42](https://github.com/ash-project/igniter/security/advisories/GHSA-cj7w-j579-gc42) - [https://cna.erlef.org/cves/CVE-2026-82584.html](https://cna.erlef.org/cves/CVE-2026-82584.html) - [https://github.com/ash-project/igniter/commit/d492b1aa33f8fb0dacc0afa41b703fb922d42816](https://github.com/ash-project/igniter/commit/d492b1aa33f8fb0dacc0afa41b703fb922d42816) - [https://hex.pm/packages/igniter](https://hex.pm/packages/igniter) This data is provided by [OSV](https://osv.dev/vulnerability/EEF-CVE-2026-82584). </details> --- ### Release Notes <details> <summary>ash-project/igniter (igniter)</summary> ### [`v0.8.4`](https://github.com/ash-project/igniter/blob/HEAD/CHANGELOG.md#v084-2026-09-07) [Compare Source](https://github.com/ash-project/igniter/compare/v0.8.3...v0.8.4) ##### Bug Fixes: - strip terminal control sequences from hex install confirmation metadata (CVE-2026-82584) by Zach Daniel - restore application env exactly after evaluating project config ([#400](https://github.com/ash-project/igniter/issues/400)) by neilberkman - Control rerunning installers for existing packages ([#399](https://github.com/ash-project/igniter/issues/399)) by mvanhorn - unbreak `mix igniter.upgrade --git-ci`, and positional args after flags ([#397](https://github.com/ash-project/igniter/issues/397)) by James Harton - stop boolean flags consuming the following positional arg by James Harton - don't require a package list for `igniter.upgrade --git-ci` by James Harton ### [`v0.8.3`](https://github.com/ash-project/igniter/blob/HEAD/CHANGELOG.md#v083-2026-07-26) [Compare Source](https://github.com/ash-project/igniter/compare/v0.8.2...v0.8.3) ##### Bug Fixes: - ensure verbose is passed all the way down by Zach Daniel - properly check `igniter.rms` in `--check` by Zach Daniel - resolve Elixir 1.20 type-check warnings ([#387](https://github.com/ash-project/igniter/issues/387)) by Gilbert ##### Improvements: - add `Igniter.Libs.Phoenix.web_module_for_router/2` ([#393](https://github.com/ash-project/igniter/issues/393)) by James Harton - update to Elixir 1.20 ([#391](https://github.com/ash-project/igniter/issues/391)) by ESmithByui - direct users to format command for unless refactor by Zach Daniel </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate added the

security

label

2026-10-08 14:23:30 +02:00

renovate added 1 commit

2026-10-08 14:23:30 +02:00

chore(deps): update dependency igniter to v0.8.4 [security]

continuous-integration/drone/push Build was killed

Details

548c3ad653

renovate force-pushed renovate/hex-igniter-vulnerability from 548c3ad653

continuous-integration/drone/push Build was killed

Details

to cd0b64c783