The gdu program fails to strip terminal escape sequences from directory and file names when it prints them after exiting the TUI. An attacker can create or place maliciously crafted names containing ANSI escape codes in directories or files. When gdu displays those names, the terminal interprets the escape codes, allowing title spoofing, clipboard manipulation, or other terminal-dependent effects. The vulnerability does not provide direct code execution but can mislead users or alter terminal behavior during a session.

The vulnerability affects the gdu utility developed by Dundee. No version information is listed, so all current releases prior to the recent fix are considered vulnerable. Users running any gdu installation that has not applied the upstream patch or upgrade are impacted.

The CVSS score of 4.8 indicates moderate risk. The EPSS score of 0.00119 (less than 1%) reflects a very low likelihood of exploitation, and the vulnerability is not listed in CISA KEV. The likely attack vector is local; an attacker who can place files or directories with crafted names on a disk that the user scans with gdu can trigger the terminal effect when the paths are displayed. The vulnerability exploits normal gdu display logic without special privileges, making it relatively easy to abuse in a trusted user context.