That’s how the new Linux Terminal Bug known as Sidecar Injection starts. A single vector slips past the expected shell behavior, chaining into privilege escalation and targeted code execution. Sidecar Injection rides alongside legitimate processes, blending in, almost invisible. By the time it’s discovered, it can already pivot into remote access and data exfiltration.
The flaw lives in the way certain interactive shells parse and forward input between multiplexed sessions. When combined with vulnerable terminal emulators, the injected payload can execute inside a trusted context without leaving traces in the main audit logs. It moves fast because it exploits trust—the trust that the terminal, its shell, and its I/O layer will behave exactly as expected.
This bug is both local and network-exploitable. Local exploitation can occur through shared sessions or compromised developer tools. Network exploitation surfaces when attackers can influence the terminal directly through SSH connections, containerized environments, or attach to PTYs in orchestration clusters. Once inside, Sidecar Injection can sidestep restrictions meant for isolated users, harvest credentials loaded in memory, and alter build workflows.