Live › vulnerability › CVE-2026-121547
Canop dysk, a disk usage tool, prints FUSE mount-point names and fsname values into its table and CSV output without sanitizing terminal escape sequences. A local user who creates a crafted FUSE mount can hide or spoof output and change the window title of another user who runs dysk.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Only people who run dysk on a machine where other local users can create FUSE mounts, such as shared hosts or multi-user workstations. Exploitation needs a local account and a victim running dysk; a single-user machine is low exposure.
No product ranges from the sources yet.
dysk --version and compare against the fixed version.dysk and look for FUSE mounts whose names you did not create, if you use a shared machine.3.8.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject control sequences by crafting mount metadata rendered unsanitized in table and CSV output. Attackers can create FUSE mounts with ESC/OSC sequences in mount-point names or fsname, causing spoofed or hidden output and window-title changes when another user runs dysk.
This page as .md · .json · in your agent: get_signal("CVE-2026-121547")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.