CVE-2026-73480

4.8 mediumEPSS 0.2%

Medium (4.8). EPSS 0.2% chance of exploitation in the next 30 days.

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects.

Severity

CVSS 4.0

4.8 medium

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

5.0 medium

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 6% of CVEs (scores of 2026-10-31)
CWE: CWE-116
Published: 2026-08-13
Modified: 2026-09-24
Record from: the NVD, synced 2026-10-19

References

https://github.com/dundee/gdu
https://github.com/dundee/gdu/commit/fe605ecd9ad0e0f1c7ba84131ddfa1c83c52406f
https://github.com/dundee/gdu/issues/615
https://www.vulncheck.com/advisories/gdu-terminal-injection-via-unstripped-escape-sequences

Check your stack JSON