CVE-2026-73479
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator, enabling title spoofing, clipboard manipulation, or other escape-sequence attacks.
Risk Assessment
Users may be deceived by a spoofed window title or clipboard manipulation, potentially leading to data leakage or unintended actions in the terminal.
Recommendation
Update dua-cli to a version that filters escape sequences. Avoid printing untrusted file names in the terminal.
Original NVD description (English source)
dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator when printed, enabling title spoofing, clipboard manipulation, or other escape-sequence attacks.