CVE catalog

CVE-2026-73480

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that ar

[CVE catalog]

Severity
Medium · CVSS 5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.17% · Oct 25, 2026

gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangdusid5.36.1-1vulnerable
Debiangduforky5.36.1-1vulnerable
Debiangdutrixie5.25.0-1vulnerable
Debiangdubookworm5.22.0-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangdusourcesid(unfixed)unimportantNot reported[1144461]
Debiangdusourceforky(unfixed)unimportantNot reported[1144461]
Debiangdusourcetrixie(unfixed)unimportantNot reported[1144461]
Debiangdusourcebookworm(unfixed)unimportantNot reported[1144461]

[Debian bug #1144461]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [gdu]Affected

    Source package: [gdu]

    Details (2)

    • 5.22.0-1+b1 · amd64 · bookworm

      Affected

      nvd · gdu · debian · bookworm; nvd · gdu · debian · 12

    • 5.22.0-1+b1 · arm64 · bookworm

      Affected

      nvd · gdu · debian · bookworm; nvd · gdu · debian · 12

[Debian 13 (Trixie)]

  • [gdu]Affected

    Source package: [gdu]

    Details (2)

    • 5.25.0-1+b8 · amd64 · trixie

      Affected

      nvd · gdu · debian · 13

    • 5.25.0-1+b8 · arm64 · trixie

      Affected

      nvd · gdu · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]