CVE-2026-73480 in gdu
Summary
by MITRE • 08/13/2026
gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability in gdu involves a failure to properly sanitize terminal escape sequences from directory and file names during path display operations, particularly when transitioning from terminal user interface mode to standard output. This issue arises from insufficient input validation and sanitization of file system metadata that contains control characters and escape sequences typically used for terminal formatting and manipulation. When the application exits its TUI mode and prints directory or file paths to stdout, it fails to strip these potentially malicious escape sequences that may have been embedded within the actual file or directory names.
This security flaw stems from a fundamental weakness in the application's text processing pipeline where user-controllable data is not adequately sanitized before being rendered to terminal output. The vulnerability can be categorized under CWE-174, which deals with insufficient sanitization of control characters, and more specifically aligns with CWE-772 which addresses improper neutralization of special elements used in terminal escape sequences. Attackers can exploit this by creating file or directory names that contain ANSI escape codes or similar terminal control sequences, which then get executed when displayed by the terminal application.
The operational impact of this vulnerability extends beyond simple display issues and can enable sophisticated terminal-based attacks. When malicious escape sequences are embedded within file names, they can trigger various terminal manipulation behaviors including title spoofing where attackers can change the terminal window title to misleading values, clipboard manipulation that could steal or inject data from/to the system clipboard, or even cursor positioning that could interfere with user operations. These effects can be particularly dangerous in environments where users interact with multiple applications or when automated scripts process directory listings.
The vulnerability demonstrates characteristics consistent with techniques described in the ATT&CK framework under T1059 for command and scripting interpreter and T1071 for application layer protocol, as it leverages terminal escape sequences to execute unintended behaviors. In practical attack scenarios, this could enable attackers to create deceptive file system structures that appear benign when displayed but actually perform malicious actions upon interaction or when processed by other terminal applications. The risk is amplified in environments where users frequently view directory listings or where automated systems process and display file names without proper sanitization.
Mitigation strategies should focus on implementing comprehensive input validation and sanitization of all file system metadata before rendering to terminal output. Applications should employ strict character filtering that removes or escapes control characters and escape sequences from user-controllable data elements. Additionally, proper encoding mechanisms such as HTML entity encoding or similar approaches should be implemented when displaying file names in terminal environments. System administrators should consider implementing monitoring for unusual directory or file naming patterns that might indicate attempts to exploit this vulnerability, while developers should ensure that all terminal output processing includes robust sanitization routines that conform to security best practices established by organizations like NIST and OWASP.