ALT-27 · Paper · 23 Oct 2026
Trojan Source: code that reads one way and runs another
Unicode characters that control text direction can make source code look different to a reviewer than to the compiler. A 2021 Cambridge paper showed it works in most languages — and what editors changed since.
- 2021Disclosed privately to compilers, editors and code-hosting platforms ahead of publication.
- 1 Nov 2021Published as CVE-2021-42574 (and CVE-2021-42694 for homoglyphs).
- AfterGitHub, GitLab, editors and compilers add warnings for hidden direction controls.
How it worked
Characters such as RIGHT-TO-LEFT OVERRIDE change display order but are invisible. Placed inside strings or comments, they let the visible text tell a different story from the token stream the compiler parses.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- Code review reviews a rendering of the code, not the code itself.
- Supply-chain defences must cover what humans see as well as what machines run.
- Invisible characters in source files are almost never legitimate.
What it means for you
- Fail CI on bidirectional control characters outside of string literals that need them.
- Keep your editor and code-hosting warnings on.
- Review dependency diffs with a tool that shows hidden characters.
Sources
- Trojan Source — trojansource.codes
- Boucher & Anderson — Trojan Source: Invisible Vulnerabilities (arXiv)
- NVD — CVE-2021-42574
Altumptic was not involved in this research. Figures are as published by the sources above.
Cite this entry
Altumptic Lab (2026). ALT-27 — Trojan Source: code that reads one way and runs another. 23 Oct 2026. altumptic.com/research/trojan-source-2021