Oh My Posh re-renders the resolved path string containing raw folder names through the Go text/template engine, which exposes a cmd function that executes arbitrary OS commands. Since folder names are inserted verbatim and then parsed as templates, any Go template syntax in a directory name is evaluated during prompt rendering. This leads to arbitrary command execution as the current user when the shell is inside or below such a directory. The vulnerability affects all path styles including the default configuration and is exploitable by placing crafted directory names in cloned repositories, archives, network shares, or removable drives. The vulnerability is present in versions prior to 29.35.1.

An attacker can achieve arbitrary command execution with the privileges of the user running Oh My Posh by creating or controlling directory names containing malicious Go template expressions. This execution occurs when the shell prompt renders after changing into or being within such directories. The impact includes full compromise of the user's environment, data, and potentially further system access depending on user privileges. The vulnerability affects multiple path styles and the default configuration, making it broadly exploitable in affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Suggested fixes include avoiding re-parsing the composed path as a template after inserting untrusted folder names, rendering configuration templates individually before concatenation, escaping template delimiters in folder names, or using a restricted function map without command execution capabilities for path rendering. Until a patch is available, avoid navigating into directories with untrusted or attacker-controlled names that may contain template expressions.