{"id":"CVE-2026-121547","kind":"vulnerability","aliases":["CVE-2026-121547"],"related":[],"title":"dysk: unsanitized mount metadata lets local users spoof terminal output","description":"Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject control sequences by crafting mount metadata rendered unsanitized in table and CSV output. Attackers can create FUSE mounts with ESC/OSC sequences in mount-point names or fsname, causing spoofed or hidden output and window-title changes when another user runs dysk.","summary":"Canop dysk, a disk usage tool, prints FUSE mount-point names and fsname values into its table and CSV output without sanitizing terminal escape sequences. A local user who creates a crafted FUSE mount can hide or spoof output and change the window title of another user who runs dysk.","severity":"low","cvss":2.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dysk","linux","package","shared-hosts"],"not_affected_if":["dysk-3.8.2-or-later","single-user-machine"],"how_to_check":"- Run `dysk --version` and compare against the fixed version.\n- Run `dysk` and look for FUSE mounts whose names you did not create, if you use a shared machine.","fix":"- Upgrade dysk to `3.8.2` or later.","status":"open","published_at":"2026-11-03T16:17:26+00:00","first_seen_at":"2026-11-03T16:21:43+00:00","triaged_at":"2026-11-03T16:24:26+00:00","updated_at":"2026-11-03T16:24:26+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T16:24:26Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade dysk to `3.8.2` or later.","reach":"local","title":"dysk: unsanitized mount metadata lets local users spoof terminal output","impact":"low","summary":"Canop dysk, a disk usage tool, prints FUSE mount-point names and fsname values into its table and CSV output without sanitizing terminal escape sequences. A local user who creates a crafted FUSE mount can hide or spoof output and change the window title of another user who runs dysk.","audience":"developers","category":"package","nicknames":[],"who_cares":["dysk","linux","shared-hosts"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"spoofed or hidden terminal output and window-title changes for the viewer","analyst_note":"","how_to_check":"- Run `dysk --version` and compare against the fixed version.\n- Run `dysk` and look for FUSE mounts whose names you did not create, if you use a shared machine.","plain_action":"","needs_analyst":false,"not_affected_if":["single-user-machine","dysk-3.8.2-or-later"],"who_is_affected":"Only people who run dysk on a machine where other local users can create FUSE mounts, such as shared hosts or multi-user workstations. Exploitation needs a local account and a victim running dysk; a single-user machine is low exposure.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000671,"input_tokens":4190,"output_tokens":503,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-121547':13A,16A '-2026':12A,15A '3.8.2':77C 'allow':86C 'anoth':69B,130C 'attack':104C 'canop':23B,74C 'caus':119C 'chang':64B,128C 'contain':78C 'control':91C 'craft':55B,94C 'creat':53B,106C 'csv':42B,102C 'cve':11A,14A 'disk':26B 'dysk':1A,17B,24B,73B,75C,133C 'esc/osc':110C 'escap':47B,81C 'fsname':36B,118C 'fuse':30B,56B,107C 'hidden':122C 'hide':59B 'host':22B 'inject':83C,90C 'let':5A 'linux':18B 'local':6A,50B,87C 'metadata':4A,96C 'mount':3A,32B,57B,95C,108C,114C 'mount-point':31B,113C 'name':34B,116C 'output':10A,43B,62B,103C,123C 'packag':19B 'point':33B,115C 'print':29B 'render':97C 'run':72B,132C 'sanit':45B 'sequenc':48B,82C,92C,111C 'share':21B 'shared-host':20B 'spoof':8A,61B,120C 'tabl':40B,100C 'termin':9A,46B,80C 'titl':67B,127C 'tool':28B 'unsanit':2A,98C 'usag':27B 'user':7A,51B,70B,88C,131C 'valu':37B 'vulner':84C 'window':66B,126C 'window-titl':125C 'without':44B","nicknames":[],"mitigations":[],"who_affected":"Only people who run dysk on a machine where other local users can create FUSE mounts, such as shared hosts or multi-user workstations. Exploitation needs a local account and a victim running dysk; a single-user machine is low exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dysk","linux","low","package","sharedhosts"],"first_public_at":"2026-11-03T16:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121547","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121547","severity":null,"published_at":"2026-11-03T16:17:26+00:00","modified_at":"2026-11-03T16:17:26+00:00","first_seen_at":"2026-11-03T16:21:43+00:00","fetched_at":"2026-11-03T16:21:43+00:00","note":null}],"documents":[{"id":58830,"url":"https://github.com/Canop/dysk/commit/726f4f554d7c1ede21363c29b593ab130ca28d86","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58831,"url":"https://www.vulncheck.com/advisories/dysk-before-3.8.2-terminal-escape-sequence-injection-via-mount-metadata","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}