Medium severity5.0NVD Advisory· Published Aug 13, 2026

CVE-2026-73480

Description

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Dundee/gdullm-create

Patches

Vulnerability mechanics

References

github.com/dundee/gdu/commit/fe605ecd9ad0e0f1c7ba84131ddfa1c83c52406fnvd
github.com/dundee/gdu/issues/615nvd
www.vulncheck.com/advisories/gdu-terminal-injection-via-unstripped-escape-sequencesnvd

News mentions

No linked articles in our index yet.

cvss	0.325
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000