CVE-2026-73480: gdu Terminal Injection via Unstripped Escape Sequences
Published Aug 13, 2026
·Updated
gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects.
Affected Software
1 affected component
gdu
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate terminal-injection impacts by preventing untrusted directory/file names from being displayed in terminal contexts (e.g., avoid viewing untrusted paths with gdu in an interactive terminal, or ensure terminal emulator clipboard/title features are disabled) until the escape-sequence stripping issue in gdu is fixed.
Event History
Aug 13, 2026
CVE Published
via MITRE·09:07 PM
Data Sourced
via MITRE·09:07 PM
DescriptionSeverityWeakness