From 848a9bc9e1a426423151e4abccdae3d4ecf51500 Mon Sep 17 00:00:00 2001
From: tt-a1i <53142663+tt-a1i@users.noreply.github.com>
Date: Thu, 18 Jun 2026 18:07:22 +0800
Subject: [PATCH] fix(cli): reject malformed terminal sequences

---
 packages/cli/src/utils/terminalSequence.test.ts | 6 ++++++
 packages/cli/src/utils/terminalSequence.ts      | 5 ++---
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/packages/cli/src/utils/terminalSequence.test.ts b/packages/cli/src/utils/terminalSequence.test.ts
index edabef23a72..a914c40478b 100644
--- a/packages/cli/src/utils/terminalSequence.test.ts
+++ b/packages/cli/src/utils/terminalSequence.test.ts
@@ -114,6 +114,12 @@ describe('parseAllowedTerminalSequences', () => {
     it('rejects OSC with no numeric code', () => {
       expect(parseAllowedTerminalSequences('\x1b];hello\x07')).toBeNull();
     });
+
+    it('rejects OSC when the code is not followed by a separator', () => {
+      expect(parseAllowedTerminalSequences('\x1b]9oops\x07')).toBeNull();
+      expect(parseAllowedTerminalSequences('\x1b]9\x07')).toBeNull();
+      expect(parseAllowedTerminalSequences('\x1b]9\x1b\\')).toBeNull();
+    });
   });
 });
 
diff --git a/packages/cli/src/utils/terminalSequence.ts b/packages/cli/src/utils/terminalSequence.ts
index 356f1b48a90..48c3c4eb8f3 100644
--- a/packages/cli/src/utils/terminalSequence.ts
+++ b/packages/cli/src/utils/terminalSequence.ts
@@ -85,9 +85,8 @@ function parseOscSequence(input: string, start: number): OscParseResult | null {
   const oscCode = Number(codeStr);
   if (!ALLOWED_OSC_CODES.has(oscCode)) return null;
 
-  // After the code, expect ';' or a terminator
-  // (OSC 0/1/2 can have just a title with ';')
-  if (position >= input.length) return null;
+  // After the code, require ';' before the payload.
+  if (position >= input.length || input[position] !== ';') return null;
 
   // Read until terminator: BEL or ST (ESC \)
   // The ';' after code is part of payload