Gdu
Monthly
Terminal injection in gdu, a Go-based disk usage analyzer, allows ANSI escape sequences embedded in crafted filenames or directory names to reach the terminal emulator unfiltered after the TUI exits. Any operator who runs gdu against attacker-controlled filesystem paths — shared mounts, downloaded archives, or untrusted repositories — may have their terminal manipulated through clipboard hijacking (OSC 52), window title spoofing, or other escape-sequence-dependent effects. No public exploit code has been identified at time of analysis, and the vulnerability is absent from the CISA KEV catalog.
Terminal injection in gdu, a Go-based disk usage analyzer, allows ANSI escape sequences embedded in crafted filenames or directory names to reach the terminal emulator unfiltered after the TUI exits. Any operator who runs gdu against attacker-controlled filesystem paths — shared mounts, downloaded archives, or untrusted repositories — may have their terminal manipulated through clipboard hijacking (OSC 52), window title spoofing, or other escape-sequence-dependent effects. No public exploit code has been identified at time of analysis, and the vulnerability is absent from the CISA KEV catalog.