Hi,

The following vulnerability was published for gdu.

CVE-2026-73480[0]:
| gdu fails to strip terminal escape sequences from directory and file
| names when printing paths after TUI exit. Attackers can craft
| malicious directory or file names containing escape sequences that
| are interpreted by the terminal, enabling title spoofing, clipboard
| manipulation, or other terminal-dependent effects.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-73480
https://www.cve.org/CVERecord?id=CVE-2026-73480
[1] https://github.com/dundee/gdu/issues/615
[2] https://github.com/dundee/gdu/pull/616
[3] https://github.com/dundee/gdu/commit/5d76fab735f190fd645896de90ac9982b6382aeb

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore