Description

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.0",
  "pubDate": "2026-08-13T21:18:32.187Z",
  "pubdate": "2026-08-13T21:18:32.187Z",
  "executiveSummary": "A terminal escape sequence injection vulnerability exists in gdu where the application fails to adequately sanitize terminal control characters from directory and file names when rendering paths to standard output after the terminal user interface (TUI) exits. This vulnerability impacts the gdu disk usage analyzer utility. The primary security implication is the potential for terminal spoofing, unauthorized clipboard manipulation, and execution of arbitrary terminal-dependent control sequences. An attacker capable of creating or influencing file and directory names within a filesystem scanned by gdu can leverage this flaw. When a victim interacts with gdu and the tool terminates its TUI session, the malicious paths containing raw escape sequences are printed to the console, where the host terminal emulator interprets them as control commands rather than literal strings. Exploitation requires the attacker to position malformed filenames within the target environment, relying on the user to execute gdu against the compromised directory structure. No advanced privileges or network access are required for the initial payload placement, as local filesystem access or ingestion of untrusted archives containing malicious paths is sufficient to stage the attack vector.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of input sanitization and output encoding within gdu when handling untrusted string data sourced from filesystem metadata. Specifically, file and directory names retrieved via filesystem traversal interfaces are passed directly to output rendering routines without stripping or escaping ANSI escape codes, carriage returns, or other terminal control sequences.\nThe vulnerable component involves the output handling logic executed immediately following the teardown of the interactive TUI. As gdu exits and prints summary paths or final navigation states to standard output, strings containing raw terminal escape sequences bypass sanitization filters. When these unescaped byte sequences are rendered by the terminal emulator, the terminal's parser processes them as native control instructions rather than printing them as benign textual characters.\nThe attack flow proceeds in a deterministic sequence. First, an attacker establishes malicious file or directory names containing targeted ANSI escape sequences (such as OSC - Operating System Command sequences, or CSI - Control Sequence Introducer sequences) on a target filesystem. This can be achieved through local file creation, the extraction of a maliciously crafted archive, or the cloning of an untrusted remote repository. Second, the victim executes gdu against the directory containing the malicious nomenclature. Third, the victim navigates the TUI or simply terminates the application. Fourth, upon TUI exit, gdu dumps the affected file or directory paths to the controlling terminal. Finally, the terminal emulator interprets the embedded escape sequences, leading to unintended side effects.\nPayload behavior depends entirely on the specific escape sequences injected by the attacker. Potential terminal-dependent effects include terminal title spoofing to deceive the user regarding the current working context, reading or writing to the system clipboard via OSC 52 sequences, clearing the screen, injecting arbitrary text into the user's shell command line buffer, or altering text colors and visibility to obscure subsequent terminal output.\nRegarding execution constraints, the vulnerability requires no authentication, no network exposure, and operates purely within the local terminal context. Privilege requirements are limited to the ability to create files or directories with malicious names within a path that the victim subsequently scans with gdu. The post-exploitation impact is constrained by the capabilities and security configuration of the victim's terminal emulator, though successful exploitation can facilitate social engineering, clipboard exfiltration, or user interface deception."
}