CVE-2026-73480

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73480", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-12T18:19:17.024Z", "datePublished": "2026-08-13T21:07:18.686Z", "dateUpdated": "2026-09-24T14:19:08.777Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-24T14:19:08.777Z"}, "datePublic": "2026-08-13T00:00:00.000Z", "title": "gdu Terminal Injection via Unstripped Escape Sequences", "descriptions": [{"lang": "en", "value": "gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects."}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-116", "description": "Improper Encoding or Escaping of Output", "type": "CWE"}]}], "affected": [{"vendor": "dundee", "product": "gdu", "defaultStatus": "affected", "packageURL": "pkg:golang/github.com/dundee/gdu/v5", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThan": "fe605ec"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "version": "3.1", "baseSeverity": "MEDIUM", "baseScore": 5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "references": [{"url": "https://github.com/dundee/gdu/issues/615", "tags": ["issue-tracking"], "name": "GitHub Issue #615"}, {"url": "https://github.com/dundee/gdu", "tags": ["product"], "name": "Product Repository"}, {"url": "https://www.vulncheck.com/advisories/gdu-terminal-injection-via-unstripped-escape-sequences", "tags": ["third-party-advisory"]}, {"url": "https://github.com/dundee/gdu/commit/fe605ecd9ad0e0f1c7ba84131ddfa1c83c52406f", "name": "Patch Commit", "tags": ["patch"]}], "credits": [{"lang": "en", "value": "George Chen", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-14T19:34:22.229575Z", "id": "CVE-2026-73480", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-14T19:36:14.616Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-73480", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-14T19:34:22.229575Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-14T19:36:11.201Z"}}], "cna": {"title": "gdu Terminal Injection via Unstripped Escape Sequences", "credits": [{"lang": "en", "type": "finder", "value": "George Chen"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "dundee", "product": "gdu", "versions": [{"status": "affected", "version": "0", "lessThan": "fe605ec", "versionType": "custom"}], "packageURL": "pkg:golang/github.com/dundee/gdu/v5", "defaultStatus": "affected"}], "datePublic": "2026-08-13T00:00:00.000Z", "references": [{"url": "https://github.com/dundee/gdu/issues/615", "name": "GitHub Issue #615", "tags": ["issue-tracking"]}, {"url": "https://github.com/dundee/gdu", "name": "Product Repository", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/gdu-terminal-injection-via-unstripped-escape-sequences", "tags": ["third-party-advisory"]}, {"url": "https://github.com/dundee/gdu/commit/fe605ecd9ad0e0f1c7ba84131ddfa1c83c52406f", "name": "Patch Commit", "tags": ["patch"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "Improper Encoding or Escaping of Output"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-24T14:19:08.777Z"}}}, "cveMetadata": {"cveId": "CVE-2026-73480", "state": "PUBLISHED", "dateUpdated": "2026-09-24T14:19:08.777Z", "dateReserved": "2026-08-12T18:19:17.024Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-13T21:07:18.686Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "packageURL": "pkg:golang/github.com/dundee/gdu/v5", "product": "gdu", "vendor": "dundee", "versions": [{"lessThan": "fe605ec", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects."}], "id": "CVE-2026-73480", "lastModified": "2026-09-24T20:06:30.133", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 2.7, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73480", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-14T19:34:22.229575Z", "version": "2.0.3"}}]}, "published": "2026-08-13T21:18:32.187", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/dundee/gdu"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/dundee/gdu/commit/fe605ecd9ad0e0f1c7ba84131ddfa1c83c52406f"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/dundee/gdu/issues/615"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/gdu-terminal-injection-via-unstripped-escape-sequences"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-116"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/dundee/gdu: gdu: Terminal Injection via Unstripped Escape Sequences", "id": "2515738", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515738"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-838", "details": ["gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects.", "A flaw was found in gdu, a disk usage analyzer. This vulnerability occurs because gdu does not properly remove terminal escape sequences from directory and file names when displaying paths after exiting its Text-based User Interface (TUI). An attacker can craft malicious directory or file names containing these escape sequences. When a user views these names, their terminal interprets the sequences, which could lead to unauthorized title spoofing, clipboard manipulation, or other terminal-dependent effects."], "mitigation": {"lang": "en:us", "value": "Avoid running gdu in directories where untrusted users can create files or subdirectories with crafted names. Pipe gdu output through a terminal escape filter to neutralize injected sequences."}, "name": "CVE-2026-73480", "public_date": "2026-08-13T21:07:18Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-73480\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-73480\nhttps://github.com/dundee/gdu\nhttps://github.com/dundee/gdu/commit/fe605ecd9ad0e0f1c7ba84131ddfa1c83c52406f\nhttps://github.com/dundee/gdu/issues/615\nhttps://www.vulncheck.com/advisories/gdu-terminal-injection-via-unstripped-escape-sequences"], "statement": "Red Hat products are not affected by this vulnerability as gdu is not shipped in any Red Hat product. Community packages in Fedora and EPEL are affected.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,fe605ec)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "gdu", "source": "cna", "vendor": "dundee"}, "product": "gdu", "vendor": "dundee"}], "created": "2026-08-13T22:45:03.553773+00:00", "updated": "2026-08-15T03:00:05.490280+00:00", "vendors": ["dundee", "dundee$PRODUCT$gdu"]}