CVE-2026-73479 in dua-cli
Summary
by MITRE • 08/14/2026
dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator when printed, enabling title spoofing, clipboard manipulation, or other escape-sequence attacks.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
This vulnerability resides in the dua-cli tool's handling of terminal output during its transition from interactive TUI mode to command line interface. The core issue manifests when the application prints file paths that have been marked or processed within the terminal user interface, failing to properly sanitize or filter terminal escape sequences present in the file names themselves. This represents a classic input validation flaw that directly maps to CWE-15 and CWE-74, where improper neutralization of special elements can lead to various terminal-based attacks. The vulnerability specifically affects the processing of Operating System Command (OSC) and Control Sequence Introducer (CSI) escape sequences, which are standard terminal control mechanisms used for formatting text, manipulating window titles, and controlling cursor behavior.
The operational impact of this vulnerability extends beyond simple visual disruption to encompass significant security implications for terminal environments. When attackers craft file names containing malicious escape sequences, these sequences are executed by the terminal emulator upon display, potentially enabling title spoofing attacks where the terminal window title is manipulated to deceive users about their current environment or session context. This attack vector aligns with ATT&CK technique T1059.007 for command and scripting interpreter execution, as well as T1546.008 for additional execution capabilities through terminal manipulation. The vulnerability also opens possibilities for clipboard manipulation attacks where escape sequences can be used to inject malicious content into the system clipboard, potentially leading to credential theft or other data exfiltration scenarios.
The technical exploitation of this vulnerability requires minimal prerequisites and demonstrates a fundamental flaw in how terminal applications handle user-provided data that may contain control characters. Attackers need only create files with specific escape sequence patterns within their names, then interact with dua-cli in a manner that triggers the display of these paths. The vulnerability affects any terminal environment that properly interprets OSC/CSI sequences and is particularly concerning in shared or secure environments where terminal sessions might be monitored. The attack surface includes any workflow involving dua-cli's TUI interface followed by path printing functionality, making it particularly dangerous in automated scripts or user interfaces where file names are processed without proper sanitization.
Mitigation strategies should focus on implementing robust input sanitization and output filtering mechanisms within the application. The most effective approach involves applying strict escape sequence filtering during the display of any user-provided data, ensuring that terminal control characters are either escaped or removed before output processing. This solution directly addresses CWE-74 by properly neutralizing special elements in the output stream. Additionally, implementing proper input validation and sanitization at the point where file names are processed within the TUI interface would prevent malicious sequences from entering the display pipeline entirely. System administrators should also consider implementing terminal security policies that limit the execution of escape sequences or monitor for unusual sequence patterns in terminal sessions. The vulnerability highlights the importance of considering terminal security implications in application design and aligns with security best practices outlined in NIST SP 800-171 for handling untrusted data in computing environments.