CVE-2026-73479

Received Received - Intake

Terminal Escape Sequence Injection in dua-cli

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description

dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator when printed, enabling title spoofing, clipboard manipulation, or other escape-sequence attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-73479

EUVD

EUVD-2026-58481

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

Executive Summary

The vulnerability in dua-cli involves improper filtering of terminal escape sequences when displaying marked file paths after exiting the terminal user interface (TUI). Attackers can create filenames containing special escape sequences that manipulate terminal behavior, such as spoofing window titles or altering clipboard contents, when the filenames are printed.

Detection Guidance

Check for files with names containing terminal escape sequences like OSC or CSI. Inspect terminal output logs for unexpected title changes or clipboard actions after using dua-cli.

Impact Analysis

This vulnerability could allow attackers to trick you into performing unintended actions by manipulating terminal output. For example, a malicious filename might change the terminal window title to mimic a trusted application or alter clipboard contents to insert harmful commands.

Mitigation Strategies

Update dua-cli to the latest version. Avoid using untrusted files with dua-cli. Configure terminal emulators to ignore or sanitize escape sequences in file names.

Hi! I’m here to help you understand CVE-2026-73479. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70