CVE-2026-121547: dysk before 3.8.2 Terminal Escape Sequence Injection via Mount Metadata

Published Nov 3, 2026

Updated

Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject control sequences by crafting mount metadata rendered unsanitized in table and CSV output. Attackers can create FUSE mounts with ESC/OSC sequences in mount-point names or fsname, causing spoofed or hidden output and window-title changes when another user runs dysk.

Event History

Nov 3, 2026

CVE Published

via MITRE·03:17 PM

Data Sourced

via MITRE·03:17 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Event

via NVD·04:17 PM

Frequently Asked Questions

Who is realistically exposed to this issue?

Users who run affected dysk versions and view mount metadata controlled by another local user are exposed. A local attacker can create a FUSE mount whose mount-point name or fsname contains terminal control sequences.

What must an attacker do to exploit it?

The attacker needs local access and must craft mount metadata containing ESC or OSC sequences. Another user must then run dysk so the unsanitized metadata is rendered in table or CSV output.

Are default installations affected?

The provided information identifies affected dysk versions before 3.8.2, but does not state whether a particular default configuration is required. Exploitation depends on dysk rendering attacker-controlled mount metadata.

How can I tell whether I may be affected?

Check whether the installed dysk version is earlier than 3.8.2. Systems where untrusted local users can create FUSE mounts or control mount-point names or fsname values have the relevant attacker-controlled input.

CVE-2026-121547: dysk before 3.8.2 Terminal Escape Sequence Injection via Mount Metadata

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What must an attacker do to exploit it?

Are default installations affected?

How can I tell whether I may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What must an attacker do to exploit it?

Are default installations affected?

How can I tell whether I may be affected?