CVE-2026-73480
Description
A flaw was found in gdu, a disk usage analyzer. This vulnerability occurs because gdu does not properly remove terminal escape sequences from directory and file names when displaying paths after exiting its Text-based User Interface (TUI). An attacker can craft malicious directory or file names containing these escape sequences. When a user views these names, their terminal interprets the sequences, which could lead to unauthorized title spoofing, clipboard manipulation, or other terminal-dependent effects.
Statement
Red Hat products are not affected by this vulnerability as gdu is not shipped in any Red Hat product. Community packages in Fedora and EPEL are affected.
Mitigation
Avoid running gdu in directories where untrusted users can create files or subdirectories with crafted names. Pipe gdu output through a terminal escape filter to neutralize injected sequences.
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Modify Application Data; Execute Unauthorized Code or Commands
An attacker could modify the structure of the message or data being sent to the downstream component, possibly injecting commands.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
