Read the docs
TI-2026-51591 Aliases CVE-2026-73479GHSA-2m2p-wc26-4j7x

dua-cli Terminal Escape Sequence Injection via Marked Paths

Priority LOW 21CWE-116Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator when printed, enabling title spoofing, clipboard manipulation, or other escape-sequence attacks.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00168 6th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Byrondua-cliup to 2.41.1—No fix listedCNA
  • dua-cli VendorByron Affected up to 2.41.1 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-73479
  2. 2026-10-03 Alias added: GHSA-2m2p-wc26-4j7x

References

Patch 1

Other 2

  • TI-2024-23260 gix traversal outside working tree enables arbitrary code execution CVSS 3.1HIGH 8.8
  • TI-2024-27055 gitoxide's gix-path can use a fake program files location CVSS 3.1MEDIUM 6.8
  • TI-2024-21756 gix-transport indirect code execution via malicious username CVSS 3.1MEDIUM 6.4
  • TI-2024-30454 gix-path improperly resolves configuration path reported by Git CVSS 3.1MEDIUM 6.0
  • TI-2024-23269 gix refs and paths with reserved Windows device names access the devices CVSS 3.1MEDIUM 5.4
  • TI-2024-30376 gix-path uses local config across repos when it is the highest scope CVSS 3.1LOW 2.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences