---
id: CVE-2026-73480
title: >-
  gdu fails to strip terminal escape sequences from directory and file names
  when printing paths after TUI exit
summary: >-
  gdu fails to strip terminal escape sequences from directory and file names
  when printing paths after TUI exit. Attackers can craft malicious directory or
  file names containing escape sequences that are interpreted by the terminal,
  enabli…
severity: medium
cvss: 5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-116
vendor: dundee
product: gdu
affected:
  - gdu < fe605ec
published: '2026-08-13'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:06:30.133'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73480'
references:
  - url: 'https://github.com/dundee/gdu'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/dundee/gdu/commit/fe605ecd9ad0e0f1c7ba84131ddfa1c83c52406f
    label: disclosure@vulncheck.com
  - url: 'https://github.com/dundee/gdu/issues/615'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/gdu-terminal-injection-via-unstripped-escape-sequences
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.0017
epssPercentile: 0.05536
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-14T19:34:22.229575Z'
ingestedAt: '2026-09-24T15:45:56.711Z'
---

## Overview

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.