Executive brief
dua-cli is a command-line utility for analyzing disk space usage. When exiting its text-based interface and printing marked file paths, the tool fails to filter terminal escape sequences from filenames. Attackers can craft malicious filenames containing control sequences that get executed by the terminal, enabling clipboard hijacking, window title spoofing, or other terminal emulator attacks.
Technical details
The vulnerability is a terminal escape sequence injection flaw in dua-cli's output handling. When the TUI interface exits and prints a list of marked file paths, the application does not sanitize OSC (Operating System Command) or CSI (Control Sequence Introducer) sequences embedded in filenames. An attacker can create files with names containing escape sequences (e.g., `\x1b]0;malicious\x07` for title changes or `\x1b]52;c;BASE64DATA\x07` for clipboard manipulation) that are interpreted and executed by vulnerable terminal emulators. This requires the attacker to control filenames on the target system and the user to mark and exit the TUI, but no authentication or special privileges are needed. The impact ranges from social engineering via fake window titles to data exfiltration through clipboard hijacking.
Affected products
- Byron dua-cli <unknown
Timeline
- 2026-08-13: disclosed
- 2026-08-05: patched: Fix committed in pull request #362 (merge commit b6e7caf)