gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects.
https://www.vulncheck.com/advisories/gdu-terminal-injection-via-unstripped-escape-sequences
https://github.com/dundee/gdu/issues/615
https://github.com/dundee/gdu/commit/fe605ecd9ad0e0f1c7ba84131ddfa1c83c52406f
Published: 2026-08-13
Updated: 2026-08-14
Base Score: 3.6
Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:N
Severity: Low
Base Score: 5
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity: Medium
Base Score: 4.8
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Severity: Medium
EPSS: 0.00119