Canop dysk CVE-2026-121547

Exploitation requires: (1) the attacker already has a local, low-privileged account on the host able to create a FUSE mount; (2) the attacker sets a mount-point name or fsname containing ESC or OSC escape sequences; and (3) a second user subsequently runs dysk and renders its human-readable table or CSV output in an interpreting terminal. Limiting factors: it is local-only (AV:L) with low privileges required (PR:L), it depends on victim interaction (UI:A) - the vulnerability does nothing until another user runs dysk and views the output - and JSON output is unaffected because serde already escapes control bytes. Impact is confined to terminal output spoofing/hiding and window-title changes (integrity only); there is no code execution, data disclosure, or availability loss.

This is a genuinely low-priority issue, and the signals agree rather than conflict. The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:A) describes a local attack that needs an already-present low-privileged local user, a specific attack requirement (AT:P), and active interaction by a victim who must run dysk in a terminal; combined with impact limited to VI:L (no confidentiality, no availability), this yields a base score of 1.0. The vuln.today decision label is 'monitor', the lowest urgency tier, consistent with that score. There is no CISA KEV listing and no EPSS value supplied, so there is no evidence of active or probable exploitation; the vulnerability was reported by VulnCheck as a research finding and a vendor patch is already available. No conflicting signals are present - every available source points to a low-severity, local, low-impact terminal-spoofing bug rather than a remotely exploitable or widely attacked flaw. The main caveat is that no EPSS score was provided, so probabilistic exploitation likelihood cannot be independently confirmed, but given AV:L and UI:A the practical risk is clearly minor.

On a multi-user Linux host, an unprivileged user creates a FUSE mount whose mount-point name or fsname embeds ESC/OSC terminal escape sequences. When an administrator or another user later runs dysk and views its table or CSV output in a terminal, the unsanitized metadata is rendered and executes the escape sequences, spoofing or hiding rows and changing the terminal window title. No public exploit code is identified at time of analysis, though the vendor's patch commit includes a test that constructs malicious mounts demonstrating the technique.