CVE-2026-73480

Name	CVE-2026-73480
Description	gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1144461

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gdu (PTS)	bookworm	5.22.0-1	vulnerable
	trixie	5.25.0-1	vulnerable
	forky, sid	5.36.1-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
gdu	source	(unstable)	(unfixed)	unimportant		1144461

Notes

https://github.com/dundee/gdu/issues/615
https://github.com/dundee/gdu/pull/616
Fixed by: https://github.com/dundee/gdu/commit/5d76fab735f190fd645896de90ac9982b6382aeb
Not considered a security issue, needs to be correctly handled in the terminal emulators