CVE-2026-73480

The EPSS score of 0.00119 is accurate, but it's measuring commodity exploitability — not the probability of a targeted attack against the right victim. That's a distinction that matters for gdu specifically. This is a terminal escape sequence injection vulnerability in the code path that prints paths after the TUI exits. For exploitation, an attacker needs a maliciously-named directory where a gdu user will navigate, the specific print statement to trigger, and the user's terminal to interpret the escape sequences before they notice. That's a high-interaction chain that commodity malware won't bother with. But clip the clipboard manipulation vector into focus and the picture changes. Escape sequences can inject clipboard writes — not just spoof terminal titles. For a tool frequently run by sysadmins and security researchers on sensitive systems, a successful clipboard hijack could harvest credentials from users who just copied a password or API key. The blast radius isn't cosmetic terminal weirdness; it's credential substitution. Here's what should concern you more than the CVE itself: gdu has no centralized output sanitization layer. Every code path that prints user-controlled filenames is a potential instance of this vulnerability. The CVE likely describes one specific print statement — but what about --json output? Error handlers? Log pipelines that feed SIEMs or log aggregators? Those peripheral paths are where security assumptions rot, and they're exactly what a low-severity CVE won't force anyone to audit. There's also a population inversion worth knowing: gdu users are self-selecting for the population most likely to encounter attacker-controlled directory names (they're analyzing suspicious filesystems). But this same population is also least likely to patch promptly — they freeze tool versions for reproducibility, run from pinned container images, treat CLI tools as set-and-forget infrastructure. The CVE-to-patch exposure window compounds with elevated interaction frequency, creating risk that the EPSS makes invisible.

Reviewed through automated stages and approved by a human before publication.