CVE-2026-73479CWE-116

CVE-2026-73479

Medium · published August 14, 2026

CVSS v3.1

5.0

EPSS

Percentile

5.8

In the wild

Unconfirmed

What it is

dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator when printed, enabling title spoofing, clipboard manipulation, or other escape-sequence attacks.

The record

Technical detail

CVSS v3.1: 5.0 · MEDIUM
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0: 4.8 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS: 0.00168 · 5.8th percentile
Weakness: CWE-116 · Improper Encoding or Escaping of Output
Published: 2026-08-14T02:17Z

References (3)

https://github.com/Byron/dua-cli · [email protected]https://github.com/Byron/dua-cli/commit/b6e7cafd305c150834eb887e1de99bcdd3fca85d · [email protected]https://github.com/Byron/dua-cli/issues/365 · [email protected]

EPSS history

Timeline

13 AUG 21:17Z
dua-cli Terminal Escape Sequence Injection via Marked Paths
cvelistv5