Description
dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator when printed, enabling title spoofing, clipboard manipulation, or other escape-sequence attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Byron | dua-cli | ≤ 2.41.1 | — |
References
- GitHub Issue #365 issue-tracking
- Product Repository product
- Patch Commit patch