Escape Sequence

What’s an escape sequence?

Your terminal has one wire coming in, and everything arrives down it: the text you asked for, the error you didn’t, and the instructions for drawing all of it. So somebody had to decide how a screen tells a word to print from an order to obey. They reserved one character, number 27 in ASCII, called ESC. When the terminal sees it, it stops printing and starts taking orders. ESC [2J wipes the screen. ESC [H sends the cursor home. ESC [31m turns everything after it red until ESC [0m calms it down. The characters escape their normal meaning, hence the name.

The grammar was standardised as ECMA-48 in 1976 and adopted in America as ANSI X3.64, which is why programmers still call these ANSI escape codes. Every green tick in your test runner and every red line in a failing build is still drawn with a fifty-year-old command language that nobody has dared to replace.

The trouble with a screen that obeys any text wearing the right hat is that some of the text comes from strangers. In 2003 a crafted escape sequence could get xterm to change its window title and then type that title back onto your command line, so a file you had merely looked at could hand you a command to run (CVE-2003-0063). In 2024 iTerm2 shipped its own version of the same mistake (CVE-2024-38396). The bug is older than some of the people still fixing it. Magnetic tape never had an escape character, and the tape on this shirt found its own way out anyway.

Evidence: ANSI escape code, Wikipedia, Standards for ANSI escape codes, Julia Evans, CVE-2003-0063, xterm window title, NIST National Vulnerability Database, CVE-2024-38396, iTerm2, NIST National Vulnerability Database