wetty vulnerable to DOM XSS via file-download filename

Description

The wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string (escapeMarkup: false). Any output the victim renders - a cat‘d file, a tailed log, an SSH MOTD, a curl response - that contains \x1b[5i...:...\x1b[4i runs script in the wetty origin and types attacker-chosen keystrokes into the victim’s SSH session.

Recommendation

Update the wetty package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.0.4
• Patched version(s): 3.0.4

References

• GHSA-p26j-h7wj-r568
• CVE-2026-49864
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6