Description (CNA)
gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| dundee / gdu | affected 0 before fe605ec |
CWE
CWE-116
References
- https://github.com/dundee/gdu/issues/615
- https://github.com/dundee/gdu
- https://www.vulncheck.com/advisories/gdu-terminal-injection-via-unstripped-escape-sequences
- https://github.com/dundee/gdu/commit/fe605ecd9ad0e0f1c7ba84131ddfa1c83c52406f
ADP enrichment
No English description supplied.
No references supplied.