CVE-2026-73480

MEDIUM 5.0

gdu Terminal Injection via Unstripped Escape Sequences

CVSS Score

5.0

EPSS Score

0.0%

EPSS Percentile

0th

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects.

CWE	CWE-116
Vendor	dundee
Product	gdu
Published	Aug 13, 2026

Stay Ahead of the Next One

Get instant alerts for dundee gdu

Be the first to know when new medium vulnerabilities affecting dundee gdu are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

dundee / gdu

0 < fe605ec

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/dundee/gdu/issues/615 github.com: https://github.com/dundee/gdu vulncheck.com: https://www.vulncheck.com/advisories/gdu-terminal-injection-via-unstripped-escape-sequences github.com: https://github.com/dundee/gdu/commit/fe605ecd9ad0e0f1c7ba84131ddfa1c83c52406f

Credits

🔍 George Chen