Attacker-chosen package fields are printed unescaped, letting a hostile .ashpkg repaint the operator's trust decision #483

pkg show, pkg import and pkg pull print attacker-chosen package fields to the terminal without stripping control sequences. Proposal.Summary, ProposedBy and course Name/Detail all come from the package author — i.e. from whoever could write to the synced mesh store.

This defeats a control the code explicitly documents. PkgCommand.cs ~653-666 says the sealer fingerprint is "the only part of the line the sender cannot choose" and is "the part worth reading" for the operator's trust decision. But a CR or cursor-movement escape embedded in the adjacent attacker-chosen summary can overwrite that fingerprint line, and an embedded newline can fabricate an entire extra result row.

Reproduced with a fully-valid self-sealed package whose summary carries ESC[31m, an OSC-0 title set, CR, NUL and U+202E. Verified with | cat -v:

• ANSI colour and an OSC-0 sequence set the terminal window/tab title
• a newline forges a complete extra output line (a fake FORGED ✓ ADMITTED)
• a CR rewrites the current line — including the fingerprint line
• U+202E flips text direction (the gnp.exe → exe.png trick)

The malicious summary is printed before the gate verdict, and even for packages that are ultimately REFUSED — an import ending in REJECTED still painted the terminal first.

Sites: PkgCommand.cs:231,236 (import peek summary + course detail), :313,314,319 (show), :652,673,682,690,694 (pull per-row). No sanitizer exists anywhere in application/src/Ashlar.CLI/Formatting/ — grep for Sanitiz|IsControl|Escape returns nothing.

The Ed25519 gate checks still hold, so this is not a direct admission bypass — it is an operator-deception bug in the surface whose whole job is to inform a human trust decision.

Fix: sanitise control/escape characters in attacker-controlled fields before printing. Best placed once in the renderer rather than at each call site.

Found by the round-3 CLI hunt lane bb-pkg-adversarial (61 probes).