Vulnerability-Lookup

CVE-2026-73506 (GCVE-0-2026-73506)

Vulnerability from cvelistv5 – Published: 2026-08-13 14:23 – Updated: 2026-08-14 15:37

Title

Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data

Summary

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune) in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and RawUpstreamURL, without removing C0/C1 terminal control characters such as ESC, BEL, CSI, and OSC, allowing terminal escape sequence injection during prompt rendering that could overwrite the clipboard, spoof the prompt or screen, manipulate the window title, or disrupt the terminal. This issue is fixed in version 29.35.1.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:35 UTC

CWE

CWE-150 - Improper Neutralization of Escape, Meta, or Control Sequences

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7771 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/JanDeDobbeleer/oh-my-posh/secu…	x_refsource_CONFIRM
https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711	x_refsource_MISC
https://github.com/JanDeDobbeleer/oh-my-posh/comm…	x_refsource_MISC
https://github.com/JanDeDobbeleer/oh-my-posh/rele…	x_refsource_MISC
https://github.com/Budibase/budibase/security/adv…	exploit

Impacted products

1 product

Vendor	Product	Version	CPE status
JanDeDobbeleer	oh-my-posh	Affected: < 29.35.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73506",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:35:29.639961Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:37:42.051Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-fcrw-f7gg-6g9f"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "oh-my-posh",
          "vendor": "JanDeDobbeleer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 29.35.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune) in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and RawUpstreamURL, without removing C0/C1 terminal control characters such as ESC, BEL, CSI, and OSC, allowing terminal escape sequence injection during prompt rendering that could overwrite the clipboard, spoof the prompt or screen, manipulate the window title, or disrupt the terminal. This issue is fixed in version 29.35.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-150",
              "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T14:23:02.176Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-fwjx-9p69-h25h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-fwjx-9p69-h25h"
        },
        {
          "name": "https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711"
        },
        {
          "name": "https://github.com/JanDeDobbeleer/oh-my-posh/commit/edcf3c88f3fb582e84358b385c49d33d04c04224",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JanDeDobbeleer/oh-my-posh/commit/edcf3c88f3fb582e84358b385c49d33d04c04224"
        },
        {
          "name": "https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1"
        }
      ],
      "source": {
        "advisory": "GHSA-fwjx-9p69-h25h",
        "discovery": "UNKNOWN"
      },
      "title": "Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73506",
    "datePublished": "2026-08-13T14:23:02.176Z",
    "dateReserved": "2026-08-12T19:00:33.736Z",
    "dateUpdated": "2026-08-14T15:37:42.051Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-73506",
      "date": "2026-10-16",
      "epss": "0.00179",
      "percentile": "0.06964"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "oh-my-posh",
                "vendor": "JanDeDobbeleer",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 29.35.1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune) in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and RawUpstreamURL, without removing C0/C1 terminal control characters such as ESC, BEL, CSI, and OSC, allowing terminal escape sequence injection during prompt rendering that could overwrite the clipboard, spoof the prompt or screen, manipulate the window title, or disrupt the terminal. This issue is fixed in version 29.35.1."
          }
        ],
        "id": "CVE-2026-73506",
        "lastModified": "2026-09-09T21:02:22.660",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "LOW",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.7,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-73506",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:35:29.639961Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-13T15:20:17.133",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/JanDeDobbeleer/oh-my-posh/commit/edcf3c88f3fb582e84358b385c49d33d04c04224"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-fwjx-9p69-h25h"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-fcrw-f7gg-6g9f"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-150"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-08-14T16:18:39+00:00",
      "cve": "CVE-2026-73506",
      "id": "CVE-2026-73506",
      "initial_release_date": "2026-08-13T14:23:02.176000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "github.com/jandedobbeleer/oh-my-posh: Oh My Posh: Terminal escape sequence injection via unsanitized prompt data",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73506.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-73506",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-14T15:35:29.639961Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-14T15:37:31.450Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-fcrw-f7gg-6g9f"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "oh-my-posh",
              "vendor": "JanDeDobbeleer",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 29.35.1"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune) in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and RawUpstreamURL, without removing C0/C1 terminal control characters such as ESC, BEL, CSI, and OSC, allowing terminal escape sequence injection during prompt rendering that could overwrite the clipboard, spoof the prompt or screen, manipulate the window title, or disrupt the terminal. This issue is fixed in version 29.35.1."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "LOW",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-150",
                  "description": "CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-13T14:23:02.176Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-fwjx-9p69-h25h",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-fwjx-9p69-h25h"
            },
            {
              "name": "https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711"
            },
            {
              "name": "https://github.com/JanDeDobbeleer/oh-my-posh/commit/edcf3c88f3fb582e84358b385c49d33d04c04224",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/JanDeDobbeleer/oh-my-posh/commit/edcf3c88f3fb582e84358b385c49d33d04c04224"
            },
            {
              "name": "https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1"
            }
          ],
          "source": {
            "advisory": "GHSA-fwjx-9p69-h25h",
            "discovery": "UNKNOWN"
          },
          "title": "Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-73506",
        "datePublished": "2026-08-13T14:23:02.176Z",
        "dateReserved": "2026-08-12T19:00:33.736Z",
        "dateUpdated": "2026-08-14T15:37:42.051Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-73506

Vulnerability from fkie_nvd - Published: 2026-08-13 15:20 - Updated: 2026-09-09 21:02

Severity

6.1 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/JanDeDobbeleer/oh-my-posh/commit/edcf3c88f3fb582e84358b385c49d33d04c04224
	security-advisories@github.com	https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711
	security-advisories@github.com	https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1
	security-advisories@github.com	https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-fwjx-9p69-h25h
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/Budibase/budibase/security/advisories/GHSA-fcrw-f7gg-6g9f

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "oh-my-posh",
          "vendor": "JanDeDobbeleer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 29.35.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune) in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and RawUpstreamURL, without removing C0/C1 terminal control characters such as ESC, BEL, CSI, and OSC, allowing terminal escape sequence injection during prompt rendering that could overwrite the clipboard, spoof the prompt or screen, manipulate the window title, or disrupt the terminal. This issue is fixed in version 29.35.1."
    }
  ],
  "id": "CVE-2026-73506",
  "lastModified": "2026-09-09T21:02:22.660",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-73506",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-14T15:35:29.639961Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-13T15:20:17.133",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/JanDeDobbeleer/oh-my-posh/commit/edcf3c88f3fb582e84358b385c49d33d04c04224"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-fwjx-9p69-h25h"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-fcrw-f7gg-6g9f"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-150"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-FWJX-9P69-H25H

Vulnerability from github – Published: 2026-07-24 22:35 – Updated: 2026-08-13 14:23

Summary

Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data

Details

Summary

Oh My Posh renders dynamic, potentially attacker-controlled strings (the current directory name, Git commit metadata, environment variable values, command output) into the prompt without neutralizing raw terminal control characters. An attacker who controls one of these values can inject ANSI/OSC escape sequences that the victim's terminal executes on every prompt render. (This is separate from the path-segment command-execution report; it has a different root cause and fix.)

Details

src/terminal/writer.go, write(s rune): the literal characters of rendered segment content are emitted to the output buffer, and the only neutralization is a lookup in formats.EscapeSequences, which per shell contains only the shell's prompt-length markers (\ for bash, % for zsh, nothing for fish/pwsh/cmd/nu). Raw C0/C1 control bytes (ESC 0x1b, BEL 0x07, CSI, OSC) are written verbatim.

Oh My Posh's own styling is emitted through separate paths (writeEscapedAnsiString, writeColorise, builder.WriteString(formats.Hyperlink...)), so any control rune reaching write(s rune) originates from rendered data. trimAnsi is already applied to the console title (FormatTitle) but not to the prompt body.

Attacker-controlled sources (both verified)

Current directory name (default config, Linux/macOS). Directory names may contain any byte except / and NUL, including 0x1b. The path segment renders the working directory in every theme.
Git commit subject / author / upstream URL (cross-platform, including Windows). Git.Commit() runs git log -1 --pretty=format:...su:%s... and exposes .Commit.Subject, .Commit.Author.Name/.Email and .RawUpstreamURL; Git imposes no restriction on these, so they can carry raw escape sequences.

PoC

Git commit-subject vector (config: a single git segment with template {{ .Commit.Subject }}):

printf 'feat: \033]0;HACKED\007\033]52;c;ZWNobyBQV05FRA==\007 update' > msg.txt
git commit --allow-empty -F msg.txt
oh-my-posh print primary --config poc.omp.json --shell fish | xxd

Output (excerpt) shows the attacker's OSC 0 (set title) and OSC 52 (clipboard write) passed through unmodified, wrapped only in Oh My Posh's colors:

...255m feat: 1b5d 303b 4841 434b 4544 07 1b5d 3532 3b63 3b5a 574e ... 07 ...
              ESC ] 0 ; H A C K E D  BEL  ESC ] 5 2 ; c ; <base64>  BEL

The directory-name vector reproduces identically via the path segment.

Impact

The terminal interprets the injected sequences on every render, enabling, per emulator: clipboard hijacking (OSC 52 write, so a command placed in the clipboard runs when the victim pastes), prompt/screen spoofing, window-title manipulation, and terminal denial of service. Delivery is remote (repo/archive/share); execution is local when the prompt renders after cd.

Suggested fix: neutralize C0/C1 control characters in untrusted segment data before it reaches the terminal, at minimum the path segment (folder names) and the git segment (Commit.Subject, Commit.Author.*, RawUpstreamURL). trimAnsi already exists and is applied to the title; extending equivalent handling to segment data closes the gap. Filtering control runes in write(s rune) would also work as defense in depth (Oh My Posh's own styling never flows through that function), optionally behind an opt-out for users who deliberately embed escapes in their own templates.

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 29.35.0"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/jandedobbeleer/oh-my-posh"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "29.35.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73506"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-150"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T22:35:52Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nOh My Posh renders dynamic, potentially attacker-controlled strings (the current directory name, Git commit metadata, environment variable values, command output) into the prompt without neutralizing raw terminal control characters. An attacker who controls one of these values can inject ANSI/OSC escape sequences that the victim\u0027s terminal executes on every prompt render. (This is separate from the path-segment command-execution report; it has a different root cause and fix.)\n\n### Details\n`src/terminal/writer.go`, `write(s rune)`: the literal characters of rendered segment content are emitted to the output buffer, and the only neutralization is a lookup in `formats.EscapeSequences`, which per shell contains only the shell\u0027s prompt-length markers (`\\` for bash, `%` for zsh, nothing for fish/pwsh/cmd/nu). Raw C0/C1 control bytes (ESC `0x1b`, BEL `0x07`, CSI, OSC) are written verbatim.\n\nOh My Posh\u0027s own styling is emitted through separate paths (`writeEscapedAnsiString`, `writeColorise`, `builder.WriteString(formats.Hyperlink...)`), so any control rune reaching `write(s rune)` originates from rendered data. `trimAnsi` is already applied to the console title (`FormatTitle`) but not to the prompt body.\n\n### Attacker-controlled sources (both verified)\n1. Current directory name (default config, Linux/macOS). Directory names may contain any byte except `/` and NUL, including `0x1b`. The path segment renders the working directory in every theme.\n2. Git commit subject / author / upstream URL (cross-platform, including Windows). `Git.Commit()` runs `git log -1 --pretty=format:...su:%s...` and exposes `.Commit.Subject`, `.Commit.Author.Name`/`.Email` and `.RawUpstreamURL`; Git imposes no restriction on these, so they can carry raw escape sequences.\n\n### PoC\nGit commit-subject vector (config: a single git segment with template `{{ .Commit.Subject }}`):\n\n```\nprintf \u0027feat: \\033]0;HACKED\\007\\033]52;c;ZWNobyBQV05FRA==\\007 update\u0027 \u003e msg.txt\ngit commit --allow-empty -F msg.txt\noh-my-posh print primary --config poc.omp.json --shell fish | xxd\n```\n\nOutput (excerpt) shows the attacker\u0027s OSC 0 (set title) and OSC 52 (clipboard write) passed through unmodified, wrapped only in Oh My Posh\u0027s colors:\n\n```\n...255m feat: 1b5d 303b 4841 434b 4544 07 1b5d 3532 3b63 3b5a 574e ... 07 ...\n              ESC ] 0 ; H A C K E D  BEL  ESC ] 5 2 ; c ; \u003cbase64\u003e  BEL\n```\n\nThe directory-name vector reproduces identically via the path segment.\n\n### Impact\nThe terminal interprets the injected sequences on every render, enabling, per emulator: clipboard hijacking (OSC 52 write, so a command placed in the clipboard runs when the victim pastes), prompt/screen spoofing, window-title manipulation, and terminal denial of service. Delivery is remote (repo/archive/share); execution is local when the prompt renders after cd.\n\nSuggested fix: neutralize C0/C1 control characters in untrusted segment data before it reaches the terminal, at minimum the path segment (folder names) and the git segment (`Commit.Subject`, `Commit.Author.*`, `RawUpstreamURL`). `trimAnsi` already exists and is applied to the title; extending equivalent handling to segment data closes the gap. Filtering control runes in `write(s rune)` would also work as defense in depth (Oh My Posh\u0027s own styling never flows through that function), optionally behind an opt-out for users who deliberately embed escapes in their own templates.",
  "id": "GHSA-fwjx-9p69-h25h",
  "modified": "2026-08-13T14:23:11Z",
  "published": "2026-07-24T22:35:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-fwjx-9p69-h25h"
    },
    {
      "type": "WEB",
      "url": "https://github.com/JanDeDobbeleer/oh-my-posh/commit/edcf3c88f3fb582e84358b385c49d33d04c04224"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/JanDeDobbeleer/oh-my-posh"
    },
    {
      "type": "WEB",
      "url": "https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.36.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-73506 (GCVE-0-2026-73506)

FKIE_CVE-2026-73506

GHSA-FWJX-9P69-H25H

Summary

Details

Attacker-controlled sources (both verified)

PoC

Impact

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour