CVE-2026-73480 — gdu Terminal Injection via Unstripped Escape Sequences
gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing e…
Published: 2026-08-13 · CVSS: 4.8 · CVSS 4.0
gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7