CVE-2026-121547

LowCVSS 2.2/10Last modified Nov 3, 2026

Description

Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject control sequences by crafting mount metadata rendered unsanitized in table and CSV output. Attackers can create FUSE mounts with ESC/OSC sequences in mount-point names or fsname, causing spoofed or hidden output and window-title changes when another user runs dysk.

Metrics

CVSS 3.1 2.2/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-150

Affected software

No affected versions have been published.

Timeline

Published: Nov 3, 2026
Last modified: Nov 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1215487.8Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafte CVE-2026-1215494.4nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite f CVE-2026-121556.5IBM MQ could allow an authenticated attacker to cause a denial of service by sending specially crafted multicast status messages that trigge CVE-2026-1215503.3nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because main() accepts an ex CVE-2026-1215515.4PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by CVE-2026-1215524.3Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows auth CVE-2026-1215534.8Cotonti through 1.0.0 generates registration and email-change validation tokens with md5(microtime()), allowing attackers to bypass email-ow CVE-2026-1215545.9cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts be CVE-2026-1215557.5Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /a CVE-2026-1215568.3FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users CVE-2026-1215575.9WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp mes CVE-2026-1215584.3AuditPilot before commit 4669c93 contains an authorization bypass vulnerability in _metadata_allowed in rag/agentic_rag.py that allows authe