CVE-2026-121547

LOW 2.2

dysk before 3.8.2 Terminal Escape Sequence Injection via Mount Metadata

CVSS Score

2.2

EPSS Score

0.0%

EPSS Percentile

0th

Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject control sequences by crafting mount metadata rendered unsanitized in table and CSV output. Attackers can create FUSE mounts with ESC/OSC sequences in mount-point names or fsname, causing spoofed or hidden output and window-title changes when another user runs dysk.

CWE	CWE-150
Vendor	canop
Product	dysk
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for canop dysk

Be the first to know when new low vulnerabilities affecting canop dysk are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

Canop / dysk

0 < 3.8.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Canop/dysk/issues/125 github.com: https://github.com/Canop/dysk github.com: https://github.com/Canop/dysk/commit/726f4f554d7c1ede21363c29b593ab130ca28d86 github.com: https://github.com/Canop/dysk/blob/v3.8.1/cli/src/table.rs#L60-L75 github.com: https://github.com/Canop/dysk/pull/126 vulncheck.com: https://www.vulncheck.com/advisories/dysk-before-3.8.2-terminal-escape-sequence-injection-via-mount-metadata

Credits

George Chen