The dua-cli application fails to properly encode or escape terminal escape sequences in file paths when printing them after exiting its text user interface. Specifically, crafted file names containing Operating System Command (OSC) or Control Sequence Introducer (CSI) escape sequences are printed verbatim, allowing these sequences to be interpreted by the terminal emulator. This can lead to attacks such as terminal title spoofing or clipboard manipulation by injecting malicious escape codes into the terminal output.

An attacker who can create or influence file names viewed by dua-cli can execute terminal escape sequences on the victim's terminal emulator. This may result in misleading terminal titles, unauthorized clipboard content changes, or other escape-sequence based manipulations. The vulnerability requires user interaction (UI) and local access (local attack vector) and has a medium severity rating with a CVSS 4.8 score.

No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid opening or printing untrusted file names in dua-cli or use terminal emulators that restrict or disable interpretation of OSC/CSI sequences.