---
id: "CVE-2026-121547"
kind: "vulnerability"
aliases: ["CVE-2026-121547"]
title: "dysk: unsanitized mount metadata lets local users spoof terminal output"
severity: "low"
cvss: 2.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dysk", "linux", "package", "shared-hosts"]
not_affected_if: ["dysk-3.8.2-or-later", "single-user-machine"]
published_at: "2026-11-03T16:17:26+00:00"
first_seen_at: "2026-11-03T16:21:43+00:00"
updated_at: "2026-11-03T16:24:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121547", "first_seen_at": "2026-11-03T16:21:43+00:00"}]
---

# dysk: unsanitized mount metadata lets local users spoof terminal output

Canop dysk, a disk usage tool, prints FUSE mount-point names and fsname values into its table and CSV output without sanitizing terminal escape sequences. A local user who creates a crafted FUSE mount can hide or spoof output and change the window title of another user who runs dysk.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `dysk --version` and compare against the fixed version.
- Run `dysk` and look for FUSE mounts whose names you did not create, if you use a shared machine.

## Fix

- Upgrade dysk to `3.8.2` or later.

## Timeline

- 2026-11-03T16:21:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121547

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/dysk-before-3.8.2-terminal-escape-sequence-injection-via-mount-metadata
- [fix] Patch: github.com https://github.com/Canop/dysk/commit/726f4f554d7c1ede21363c29b593ab130ca28d86

## From the sources

Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject control sequences by crafting mount metadata rendered unsanitized in table and CSV output. Attackers can create FUSE mounts with ESC/OSC sequences in mount-point names or fsname, causing spoofed or hidden output and window-title changes when another user runs dysk.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_