CVE-2026-73480CWE-116

CVE-2026-73480

Medium · published August 14, 2026

CVSS v3.1
5.0
EPSS
0%
Percentile
6.0
In the wild
Unconfirmed
What it is

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
4.8 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00170 · 6.0th percentile
Weakness
CWE-116 · Improper Encoding or Escaping of Output
Published
2026-08-14T01:18Z
References (4)
https://github.com/dundee/gdu · [email protected]https://github.com/dundee/gdu/commit/fe605ecd9ad0e0f1c7ba84131ddfa1c83c52406f · [email protected]https://github.com/dundee/gdu/issues/615 · [email protected]https://www.vulncheck.com/advisories/gdu-terminal-injection-via-unstripped-escape-sequences · [email protected]
EPSS history
Timeline
  • 13 AUG 21:07Z
    gdu Terminal Injection via Unstripped Escape Sequences
    cvelistv5