typer.echo() writes attacker-controlled escape sequences to the terminal

[Syh-Xiong]

First Check

• I added a very descriptive title here.
• I used the GitHub search to find a similar question and didn't find it.
• I searched the documentation, with the integrated search.
• I already searched in Google "How to X" and didn't find any information.
• I already read and followed all the tutorials in the docs and didn't find an answer.

Example Code

# the clean version:
import os, sys

import typer

if __name__ == "__main__":
    typer.echo('account: root')
    typer.echo('file: SGlqYWNrZWQgYnkgVHVpSW5qZWN0aW9u report.pdf', err=True)
    typer.echo('PWNED-BY-TUI-INJECTIONnormal')


# the evil version:
import os, sys

import typer

if __name__ == "__main__":
    typer.echo('account: \x1b[2J\x1b[Hroot')
    typer.echo('file: \x1b]52;c;SGlqYWNrZWQgYnkgVHVpSW5qZWN0aW9u\x07report.pdf', err=True)
    typer.echo('\x1b]0;PWNED-BY-TUI-INJECTION\x07\x1b[41;97;1mnormal')

Description

typer.echo is click.echo re-exported; on a TTY it forwards raw ESC/OSC bytes. Typer's own error paths route user-supplied values through echo, so an invalid CLI value can clear the screen or write the clipboard. Belows are my test:

when I use clean version:

when I use evil version:

Operating System

Linux

Operating System Details

Ubuntu 22.04.5 LTS (GNU/Linux 6.8.0-124-generic x86_64)

Project Version

0.27.2

Python Version

3.10.21

Additional Context

No response

[tiangolo]

Thanks for reporting this!

typer.echo() intentionally supports terminal escape sequences, including those used for colors. Applications displaying untrusted content should escape control characters before printing it.

Your point about Typer's own error messages is worth addressing. I confirmed that some error paths include user-supplied values without escaping terminal controls, including unexpected arguments and unknown options.

I've opened PR #1972 to escape those characters. This preserves the existing behavior of typer.echo() and the original values passed to application code.

The example here demonstrates expected output behavior, but doesn't establish a security vulnerability on its own. I still consider this an edge case bug worth fixing, so it will be done in that PR, thank you!