2 files changed, 10 insertions, 2 deletions

diff --git a/src/firejail/ls.c b/src/firejail/ls.c
index 7c7f8b75f..4d0a001b6 100644
--- a/src/firejail/ls.c
+++ b/src/firejail/ls.c
@@ -233,10 +233,16 @@ void cat(const char *path) {
                 fprintf(stderr, "Error: %s is not a regular file\n", path);
                 exit(1);
         }
+        bool tty = isatty(STDOUT_FILENO);
 
         int c;
-        while ((c = fgetc(fp)) != EOF)
+        while ((c = fgetc(fp)) != EOF) {
+                // file is untrusted
+                // replace control characters when printing to a terminal
+                if (tty && c != '\t' && c != '\n' && iscntrl((unsigned char) c))
+                        c = '?';
                 fputc(c, stdout);
+        }
         fflush(stdout);
         fclose(fp);
 }
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index abb73b5e2..3b7ba4e3d 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -3036,7 +3036,9 @@ and transfer files between the container and the host filesystem.
 
 .TP
 \fB\-\-cat=name|pid filename
-Write content of a container file to standard out.
+Write content of a container file to standard out. The container is specified by name or PID.
+If standard out is a terminal, all ASCII control characters except new line and horizontal tab
+are replaced.
 
 .TP
 \fB\-\-get=name|pid filename