CVE-2026-73479

MEDIUM

CVE: CVE-2026-73479 - dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interfaceSign in to save

CVSS

5.0

CVSS v3.1

EPSS

N/A

Exploit Prediction Score

Published

August 13, 2026

Exploitability

No EPSS data available

Description

dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator when printed, enabling title spoofing, clipboard manipulation, or other escape-sequence attacks.

Weaknesses

CWE-116

Affected Packages

No package data available.

Aliases

CVE-2026-73479

Related references

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://github.com/Byron/dua-cli
https://github.com/Byron/dua-cli/commit/b6e7cafd305c150834eb887e1de99bcdd3fca85d
https://github.com/Byron/dua-cli/issues/365