The vulnerability arises when dua‑cli prints marked file paths after the TUI exits; the program fails to filter terminal escape sequences embedded in file names. Attackers can create OSC or CSI codes in a filename, causing the terminal interpreter to execute them when the path is printed. This allows malicious alteration of the terminal title, injection of clipboard data, or other escape‑sequence exploits. The weakness is an input/output encoding flaw (CWE‑116). The impact is limited to the local terminal session, potentially leading to spoofing, data leakage, and disruption of normal UI behavior.

Vendor Byron produces dua‑cli, a disk usage analyzer. No specific version range is listed, so any installed instance of dua‑cli that contains the unfixed code is affected. Users who download and run unauthenticated releases from the public repository are therefore at risk.

The CVSS score of 4.8 classifies the issue as moderate. The EPSS score is not available and the vulnerability is not in the CISA KEV catalog, indicating it is not widely exploited. Attackers must craft or place maliciously named files on a filesystem that the user can access, and the victim must run dua‑cli and view marked paths. The vector is local, relying on the presence of exploitative filenames rather than a remote trigger.