Description

dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator when printed, enabling title spoofing, clipboard manipulation, or other escape-sequence attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.0",
  "pubDate": "2026-08-13T22:17:26.747Z",
  "pubdate": "2026-08-13T22:17:26.747Z",
  "executiveSummary": "dua-cli suffers from an output sanitization vulnerability involving the failure to filter terminal escape sequences when printing marked file paths after exiting the Terminal User Interface (TUI) interface.\nThis vulnerability allows an attacker who can control or influence file names on a filesystem to craft malicious file names containing Operating System Command (OSC) and Control Sequence Introducer (CSI) escape sequences.\nWhen a victim interacts with these files inside the affected product and subsequently exits the TUI, the terminal emulator interprets the embedded escape sequences directly from the standard output stream.\nThe resulting impact includes terminal title spoofing, clipboard manipulation, cursor positioning exploits, and potential execution of arbitrary terminal control commands depending on the capabilities and configuration of the underlying terminal emulator.\nThe risk implications involve social engineering, deceptive user interfaces, and unauthorized state modifications within the user's terminal session.\nExploitation requires the attacker to successfully introduce craftily named files into a directory inspected by the victim using dua-cli, followed by user interaction that triggers the printing of marked file paths upon TUI termination.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient input validation and lack of output sanitization within dua-cli when handling string representations of marked file paths prior to writing them to the standard output upon exiting the TUI interface.\nTerminal emulators process incoming byte streams and interpret specific byte combinations as control sequences, such as ANSI escape codes, CSI sequences, and OSC sequences, which can alter terminal behavior, modify window titles, or query sensitive terminal states.\nThe vulnerable component is the output rendering routine responsible for echoing marked file paths to the user's terminal session after the interactive TUI closes.\nWhen an attacker crafts a file name embedding malicious escape sequences—such as OSC sequences designed to set the terminal window title or manipulate the clipboard—dua-cli reads these strings from the filesystem without neutralization.\nUpon exiting the TUI, dua-cli prints the raw file paths directly to the terminal stdout stream.\nThe attack flow proceeds as follows: First, the attacker creates or places a file with a maliciously crafted name containing terminal escape sequences within a directory. Second, the victim runs dua-cli targeting this directory. Third, the victim marks the target file within the TUI interface. Fourth, the victim exits the TUI. Fifth, dua-cli outputs the marked file paths to the terminal. Sixth, the terminal emulator parses the raw escape sequences embedded in the file name, executing the encoded terminal commands in the context of the victim's terminal session.\nAuthentication requirements, privilege requirements, and network exposure are not applicable factors, as this is a local user-interaction-driven vulnerability triggered by filesystem contents.\nPayload behavior depends on the injected sequences, ranging from innocuous status bar modifications to sophisticated social engineering attacks via fake prompts or hidden clipboard payloads."
}