CVE-2026-121547 in dysk
Summary
by MITRE • 11/03/2026
Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject control sequences by crafting mount metadata rendered unsanitized in table and CSV output. Attackers can create FUSE mounts with ESC/OSC sequences in mount-point names or fsname, causing spoofed or hidden output and window-title changes when another user runs dysk.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in Canop dysk prior to version 3.8.2 represents a significant security flaw rooted in the improper neutralization of special elements used in an output document or webpage, commonly classified under CWE-1054 as Terminal Escape Sequence Injection. This specific implementation weakness allows local users to inject control sequences by crafting mount metadata that is rendered without adequate sanitization when displayed in table and CSV outputs. The core technical flaw lies in the application's failure to validate or escape special characters within filesystem names, specifically allowing ESC (Escape) and OSC (Operating System Command) sequences to pass through directly into the terminal output stream. These control codes are interpreted by modern terminal emulators as instructions rather than literal text, enabling an attacker to manipulate how information is displayed on the screen.
The operational impact of this vulnerability extends beyond simple visual anomalies. By creating FUSE mounts with carefully crafted mount-point names or filesystem names containing these escape sequences, a local user can induce spoofed output, hide existing terminal content, or even change the window title of another user's session who subsequently runs dysk to view mounted devices. This capability facilitates social engineering attacks where an attacker might disguise malicious commands as benign system information or manipulate the visual context to deceive users into executing unintended actions. Furthermore, changing the window title can be used for tracking purposes or to disrupt workflow by altering the perceived state of the terminal environment, potentially leading to confusion and increased susceptibility to further exploitation vectors such as command injection if other parts of the application are also vulnerable.
From a threat modeling perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Command and Scripting Interpreter abuse, specifically those involving terminal manipulation or output redirection for evasion purposes. The attack requires local access, meaning it is primarily relevant in multi-user environments where privilege escalation or cross-user deception is possible. While the immediate impact may seem limited to visual spoofing, such vulnerabilities often serve as a precursor to more severe exploits if combined with other weaknesses like improper input validation in command execution functions.
To mitigate this risk, users must upgrade Canop dysk to version 3.8.2 or later where these sanitization issues have been addressed. In the interim, administrators should enforce strict access controls on local accounts and consider deploying terminal emulators that offer enhanced security features such as restricted escape sequence handling or sandboxed output rendering. Additionally, implementing input validation at the application level to strip or encode special characters in filesystem names before they are processed for display can prevent similar issues in other applications relying on standard mount metadata APIs. Regular auditing of local user privileges and monitoring for unusual terminal behavior can also help detect potential exploitation attempts early.