The gdu utility from dundee fails to properly encode or escape terminal escape sequences embedded in directory and file names when displaying paths after the text user interface (TUI) exits. This improper handling enables an attacker who can create or control directory or file names to inject escape sequences that the terminal interprets, potentially leading to terminal title spoofing, clipboard manipulation, or other terminal-dependent effects. The vulnerability has a CVSS 4.8 (medium) score, indicating limited impact and requiring user interaction. There is no vendor advisory or patch information available at this time.

An attacker able to create or rename files or directories with crafted escape sequences can cause the terminal to interpret these sequences after gdu exits the TUI. This may result in misleading terminal titles, unauthorized clipboard content changes, or other terminal effects that could confuse or mislead the user. The impact is limited to local or low-privilege scenarios where the attacker can influence file or directory names and the user runs gdu and views these names.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid running gdu on untrusted directories or files with potentially malicious names. Consider running gdu in a controlled environment or terminal emulator that limits escape sequence interpretation after TUI exit.