Dua Cli
Monthly
Terminal escape injection in dua-cli allows attackers who can place crafted filenames on a filesystem to manipulate the terminal emulator of any user who subsequently browses that directory with dua-cli and exits the TUI. File names containing OSC or CSI escape sequences are printed unsanitized to stdout after TUI exit, enabling terminal title spoofing, clipboard hijacking, or other escape-sequence attacks against the victim's terminal session. No public exploit code has been identified and this vulnerability is not in CISA KEV; the CVSS 4.0 score of 4.8 reflects the local attack vector and passive user interaction required, limiting realistic blast radius to shared-filesystem or multi-tenant scenarios.
Terminal escape injection in dua-cli allows attackers who can place crafted filenames on a filesystem to manipulate the terminal emulator of any user who subsequently browses that directory with dua-cli and exits the TUI. File names containing OSC or CSI escape sequences are printed unsanitized to stdout after TUI exit, enabling terminal title spoofing, clipboard hijacking, or other escape-sequence attacks against the victim's terminal session. No public exploit code has been identified and this vulnerability is not in CISA KEV; the CVSS 4.0 score of 4.8 reflects the local attack vector and passive user interaction required, limiting realistic blast radius to shared-filesystem or multi-tenant scenarios.