CVE-2026-121547 Details
Description
Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject control sequences by crafting mount metadata rendered unsanitized in table and CSV output. Attackers can create FUSE mounts with ESC/OSC sequences in mount-point names or fsname, causing spoofed or hidden output and window-title changes when another user runs dysk.
A terminal escape sequence injection vulnerability has been identified in Canop dysk versions prior to 3.8.2. This vulnerability allows local users to inject control sequences by crafting mount metadata that is rendered unsanitized in table and CSV outputs. Attackers can exploit this by creating FUSE mounts with embedded ESC/OSC sequences in mount-point names or filesystem names. When another user runs dysk, the injected sequences can spoof or hide output and change the window title.
Users can update to Canop dysk version 3.8.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Canop/dysk | [email protected] | Vendor |
| https://github.com/Canop/dysk/blob/v3.8.1/cli/src/table.rs#L60-L75 | [email protected] | Source CodeVendor |
| https://github.com/Canop/dysk/commit/726f4f554d7c1ede21363c29b593ab130ca28d86 | [email protected] | Source CodeVendor |
| https://github.com/Canop/dysk/issues/125 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/Canop/dysk/pull/126 | [email protected] | Source CodeVendor |
| https://www.vulncheck.com/advisories/dysk-before-3.8.2-terminal-escape-sequence-injection-via-mount-metadata | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-150 | Improper Neutralization of Escape, Meta, or Control Sequences | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Canop dysk | >= 0, < 3.8.2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | [email protected] |