CVE-2026-73480
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
The gdu tool fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects.
Risk Assessment
Users may be deceived by a spoofed window title or clipboard manipulation, potentially leading to unintended actions or data leakage.
Recommendation
Update gdu to a version that properly strips escape sequences, or avoid browsing directories with unknown file names.
Original NVD description (English source)
gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects.