Bracketed Paste vulnerability, end sequence in payload not escaped

[krishjainx]

What Operating System(s) are you seeing this problem on?

Linux Wayland

Which Wayland compositor or X11 Window manager(s) are you using?

Mutter

QTerminal version

1.3.0

Describe the bug

If the text you're pasting happens to contain the same sequence of characters that the terminal uses to signify the end of a paste operation, it might prematurely signal the end of the paste. This could cause the remaining part of the pasted text to be interpreted as if it were manually typed, leading to unexpected behavior.

See the second payload here: https://thejh.net/misc/website-terminal-copy-paste from Jann Horn (@thejh) of Google's Project Zero

To Reproduce

https://thejh.net/misc/website-terminal-copy-paste

Payload that is problematic:

• 2nd in link

Configuration

no config

Expected Behavior

The expected behavior of the terminal is to escape the end sequences in the payload, so that bash will not interpret those as the actual end sequence .

Logs

No response

Anything else?

gnome-terminal, wezterm, konsole, terminator etc aren't vulnerable to this issue.