What’s Vulnerable › Vulnerabilities

CVE-2026-73480: gdu Terminal Injection via Unstripped Escape Sequences

• Severity: medium (CVSS 5.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-13 · updated 2026-09-24
• Weakness: CWE-116

Description

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects.

Affected products

• dundee gdu: before fe605ec — fixed in fe605ec

How to fix

Upgrade to a fixed version: dundee gdu fe605ec. Check the vendor advisory for mitigations.

References

• https://github.com/dundee/gdu
• https://github.com/dundee/gdu/commit/fe605ecd9ad0e0f1c7ba84131ddfa1c83c52406f
• https://github.com/dundee/gdu/issues/615
• https://www.vulncheck.com/advisories/gdu-terminal-injection-via-unstripped-escape-sequences

Get alerted when CVE-2026-73480 or the next vulnerability affects your stack