Attack Chain

1. Attacker gains control of SSH server output: The attacker compromises an SSH server that the victim uses with wetty, or is another user on a shared SSH host who can write to files/logs visible to the victim.
2. Attacker crafts malicious escape sequence: The attacker prepares a base64-encoded HTML payload (e.g., <img src=x onerror="window.wetty_term.input(\"cmd\\n\",true)">) and encodes it as the filename portion of a file-download escape sequence.
3. Attacker delivers escape sequence to terminal output: The attacker uses a command like printf '\x1b[5i%s:%s\x1b[4i' "$FNAME_B64" "$DATA_B64" to emit the crafted escape sequence into the victim's SSH session output (e.g., by catting a file, tailing a log, or via MOTD).
4. Victim's wetty client processes output: The wetty client receives the terminal output containing the escape sequence and passes it through its FileDownloader.buffer.
5. Malicious filename is decoded and rendered: The FileDownloader identifies the complete escape sequence, base64-decodes the filename, and interpolates it unescaped into a Toastify notification, which renders the attacker-controlled HTML.
6. XSS payload executes in victim's browser: The injected HTML (e.g., the onerror handler) executes, calling window.wetty_term.input() with attacker-chosen commands.
7. Commands are typed into victim's SSH session: The wetty_term.input() method causes the attacker's commands to be sent to the SSH server as if the victim typed them, leading to execution (e.g., id > /tmp/pwned).
8. Information disclosure/further compromise: The attacker-injected commands execute on the SSH host, potentially leading to data exfiltration (e.g., window.wetty_term.buffer.active disclosure) or further system compromise.

Impact

This vulnerability poses a severe risk to organizations using vulnerable wetty clients. If exploited, it grants the attacker significant control over the victim's SSH session. Impact includes compromise of confidentiality, as the attacker can read the victim's rendered terminal contents via window.wetty_term.buffer.active. Integrity is also compromised through the ability to type arbitrary attacker-chosen commands into the victim's SSH session via window.wetty_term.input(), effectively achieving remote command execution. Furthermore, it presents a critical authentication bypass, allowing an attacker who can control terminal output (e.g., a low-privileged user on a shared SSH host) to gain keystroke injection capabilities into a higher-privileged user's wetty session, escalating privileges or moving laterally within the environment.

Recommendation

• Patch CVE-2026-49864 by upgrading the wetty client to version 3.0.4 or later immediately.
• Deploy the Sigma rule provided in this brief to your SIEM to detect attempts to inject malicious escape sequences via printf or similar commands within SSH sessions.
• Review SSH server command logging for unusual printf commands containing \x1b[5i and base64-encoded strings, as detected by the rule Detect Wetty DOM XSS Payload Injection Attempt.