Command Execution via Drag-and-Drop in Terminal Emulators
Summary
Security researchers have identified a technique where terminal emulators can execute arbitrary commands when users drag and drop text containing shell commands, creating a potential social engineering attack vector.
Similar Articles
@DragonsCyberHQ: Windows PnP is the loader here. Attacker-controlled device identities can make Windows fetch and run vendor code as SYS…
Security researchers release a DEF CON 34 talk and tooling showing that Windows Plug and Play can silently download and execute vendor code as SYSTEM via attacker-controlled device identities, including through USB emulation and RDP USB redirection.
all the ways in which terminals' text rendering is bad (2024)
The article explores various fundamental problems with text rendering in terminal emulators, including character definition ambiguity, Unicode handling issues, flawed 2D grid assumptions, and cursor desyncs, highlighting the difficulty of supporting complex scripts and fonts.
@CycleDecoded: Programmers and terminal freebie hunters, look here — someone actually built this. In the past, writing code meant opening a bunch of windows, switching back and forth between the black Terminal, VSCode, browser, and ChatGPT until your hands were worn out. The open-source programmer project Wave Terminal (waveterm) directly combines the command line, ...
Introducing the open-source AI terminal Wave Terminal, which integrates the command line, editor, browser, and AI into one terminal, with support for inline previews, persistent SSH sessions, and multi-model access. It has received 22k+ Stars on GitHub.
Vulnerability giving attackers full control of Macs is under active exploitation
A high-severity macOS vulnerability (CVE-2026-65400) in the screen-sharing feature is under active exploitation, allowing attackers to gain root access and install cryptocurrency miners. Apple has released patches for macOS Tahoe, Sequoia, and Sonoma.
Terminal Wrench: A Dataset of 331 Reward-Hackable Environments and 3,632 Exploit Trajectories
Researchers release Terminal Wrench, a dataset of 331 reward-hackable terminal environments with 3,632 exploit trajectories spanning sysadmin, ML, and security tasks.