CVE-2026-73480

Name	CVE-2026-73480
Description	gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gdu (PTS)	bullseye	4.6.3-1	vulnerable
	bookworm	5.22.0-1	vulnerable
	trixie	5.25.0-1	vulnerable
	forky, sid	5.36.1-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
gdu	source	(unstable)	(unfixed)

Notes

https://github.com/dundee/gdu/issues/615
https://github.com/dundee/gdu/pull/616
Fixed by: https://github.com/dundee/gdu/commit/5d76fab735f190fd645896de90ac9982b6382aeb