Bug 2515792 (CVE-2026-73479)
| Summary: | CVE-2026-73479 dua-cli: dua-cli: Terminal escape sequence injection via unfiltered marked file paths | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in dua-cli. This vulnerability allows attackers to craft malicious file names containing terminal escape sequences, specifically Operating System Command (OSC) or Control Sequence Introducer (CSI) sequences. When these marked file paths are printed after exiting the Text-based User Interface (TUI), the terminal emulator interprets these sequences. This can lead to consequences such as title spoofing or clipboard manipulation.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2524398, 2524399 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-08-13 21:49:57 UTC
|