CVE-2026-73479

dua-cli fails to sanitize terminal escape sequences in file paths it displays, allowing maliciously crafted filenames to inject control sequences into your terminal session. This is CVE-2026-73479, and while the CVSS score of 5.0 suggests moderate severity, that framing obscures the real risk. The attack requires a malicious filename to exist somewhere on your system—already placing it in the realm of 'pre-existing compromise.' But this constraint is frequently misread as 'low risk' when it actually describes dua-cli's core operating condition. This tool exists to navigate file systems, processing paths from downloads, archives, git checkouts, shared directories, and build artifacts. The 'local file' assumption is a fundamental modeling error. Your system ingests adversarial filenames routinely through supply chain contamination—tar archives, npm packages, container layers, NFS mounts—without any 'attacker placement' in the traditional sense. The deeper problem is that this vulnerability class has been documented since CVE-2003-0062 (xterm title spoofing) and persists across git, curl, ls, and dozens of core utilities. Each instance follows an identical pattern: developers optimize for the primary use case and treat output formatting as trivial plumbing. The knowledge to prevent this exists—the fix is simple (strip CSI and OSC escape sequences before printing)—but no major language's standard library defaults to safe terminal output. Python's print(), Rust's println!(), and Go's fmt.Printf() all output raw strings. The ecosystem has not wired this into developer defaults, making escape sequence vulnerabilities predictable and recurring rather than exceptional. For defenders: audit your CLI tools for unfiltered output of user-controlled strings. Implement a sanitization layer that strips control characters (particularly 0x1B and 0x5B) before terminal writes. Prioritize tools that process external or untrusted file sources—the blast radius lives downstream in your terminal emulator, where injected sequences can manipulate clipboard contents, alter window titles, or trigger display behavior depending on terminal capabilities. The EPSS score of 0.00118 likely reflects processing fatigue with this vulnerability class rather than genuine low probability; the real exposure is in cumulative, perpetually disclosed-but-incompletely-remediated risk across the entire CLI ecosystem.

Reviewed through automated stages and approved by a human before publication.