---
id: CVE-2026-121547
title: dysk before 3.8.2 Terminal Escape Sequence Injection via Mount Metadata
summary: >-
  Canop dysk before 3.8.2 contains a terminal escape sequence injection
  vulnerability that allows local users to inject control sequences by crafting
  mount metadata rendered unsanitized in table and CSV output. Attackers can
  create FUSE mo…
severity: low
cvss: 2.2
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-150
vendor: Canop
product: dysk
affected:
  - dysk < 3.8.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T17:21:16.373190Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T18:28:03.371Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121547'
references:
  - url: 'https://github.com/Canop/dysk/issues/125'
    label: 'GitHub Issue #125'
  - url: 'https://github.com/Canop/dysk'
  - url: >-
      https://github.com/Canop/dysk/commit/726f4f554d7c1ede21363c29b593ab130ca28d86
    label: Fix commit
  - url: 'https://github.com/Canop/dysk/blob/v3.8.1/cli/src/table.rs#L60-L75'
  - url: 'https://github.com/Canop/dysk/pull/126'
  - url: >-
      https://www.vulncheck.com/advisories/dysk-before-3.8.2-terminal-escape-sequence-injection-via-mount-metadata
    label: >-
      VulnCheck Advisory: dysk before 3.8.2 Terminal Escape Sequence Injection
      via Mount Metadata
tags:
  - cve.org
epss: 0.00145
epssPercentile: 0.03754
ingestedAt: '2026-11-05T20:33:06.358Z'
---

## Overview

Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject control sequences by crafting mount metadata rendered unsanitized in table and CSV output. Attackers can create FUSE mounts with ESC/OSC sequences in mount-point names or fsname, causing spoofed or hidden output and window-title changes when another user runs dysk.

## Affected

- `dysk < 3.8.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.