CVE-2026-73480
gdu Terminal Injection via Unstripped Escape Sequences
- State
- Published
- Severity
- 4.8 Medium
- Published
- Aug 13, 2026
- Updated
- Sep 24, 2026
- Reserved
- Aug 12, 2026
Description
gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.8 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 5.0 Medium | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-116 Improper Encoding or Escaping of Output
Affected Products
| Product | Versions |
|---|---|
gdudundee |
|
References
- GitHub Issue #615issue-tracking
- Product Repositoryproduct
- https://www.vulncheck.com/advisories/gdu-terminal-injection-via-unstripped-escape-sequencesthird-party-advisory
- Patch Commitpatch
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.