The vulnerability in dua-cli arises from improper encoding or escaping of output, specifically failing to filter terminal escape sequences in file names when printing marked file paths after the TUI interface exits. Attackers can exploit this by creating file names containing OSC/CSI escape sequences that, when printed, are interpreted by the terminal emulator. This can lead to attacks such as terminal title spoofing or clipboard manipulation. The CVSS 4.8 score reflects a medium severity with local attack vector, low complexity, no privileges required, and user interaction needed.

An attacker with local access can craft malicious file names that, when displayed by dua-cli, cause the terminal emulator to execute escape sequences. This can result in misleading terminal titles, unauthorized clipboard content changes, or other escape-sequence based manipulations. There is no indication of privilege escalation or direct code execution. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid marking or displaying untrusted file paths in dua-cli or use terminal emulators with mitigations against escape sequence injection.