13 matches found
CVE-2026-73480
A flaw was found in gdu, a disk usage analyzer. This vulnerability occurs because gdu does not properly remove terminal escape sequences from directory and file names when displaying paths after exiting its Text-based User Interface TUI. An attacker can craft malicious directory or file names...
EUVD-2026-58481
dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator when printed, enabling title spoofing, clipboard manipulation, or oth...
CVE-2026-73479
dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator when printed, enabling title spoofing, clipboard manipulation, or oth...
CVE-2026-73480
gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other...
CVE-2026-73479 dua-cli Terminal Escape Sequence Injection via Marked Paths
dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator when printed, enabling title spoofing, clipboard manipulation, or oth...
EUVD-2026-58477
gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other...
CVE-2026-73480 gdu Terminal Injection via Unstripped Escape Sequences
gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other...
EUVD-2026-58081
Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, writes rune in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and...
CVE-2026-73506
Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, writes rune in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and...
PT-2026-71877
dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator when printed, enabling title spoofing, clipboard manipulation, or oth...
CVE-2025-15032
Missing about:blank indicator in custom-sized new windows in Dia before 1.9.0 on macOS could allow an attacker to spoof a trusted domain in the window title and mislead users about the current site...
EUVD-2025-198517
A spoofing issue was addressed with improved truncation when displaying the fully qualified domain name This issue is fixed in Safari 18.5, macOS Sequoia 15.5. A website may be able to spoof the domain name in the title of a pop-up window...
CVE-2025-31266
The CVE-2025-31266 entry concerns a spoofing vulnerability in Safari/macOS where the domain name could be displayed inaccurately in a pop-up window’s title due to improper truncation. Connected sources confirm the affected products are Safari 18.5 and macOS Sequoia 15.5 and state that the issue w...