Oh My Posh: Arbitrary command execution via template injection in the path segment (CVE-2026-73505)
Affects github.com/jandedobbeleer/oh-my-poshSource GCVE Database
Mentioned vulnerabilities
- Patch
- Available – fixed in 29.35.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Gogithub.com/jandedobbeleer/oh-my-posh | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A patch is available for this vulnerability. Users should upgrade Oh My Posh to version 29.35.1 or later. The suggested fix involves avoiding re-parsing the composed path as a template after inserting untrusted folder names, either by rendering configuration templates individually and concatenating results or by escaping template delimiters in folder names. Until patched, users should avoid navigating into directories with untrusted or attacker-controlled names that may contain template expressions.
Description
Oh My Posh versions prior to 29.35.1 contain a vulnerability where the resolved path string is re-rendered as a Go template, evaluating any template expressions in folder names. This allows arbitrary command execution as the current user when the shell prompt renders inside or below a directory with a crafted name. The default configuration is affected, and the issue impacts multiple path styles.
Impact
An attacker who can create or control directory names in the filesystem (e.g., via cloned repositories, extracted archives, network shares, or removable drives) can execute arbitrary commands as the victim user when the shell prompt renders inside or below those directories. This can lead to full compromise of the user's environment with high confidentiality, integrity, and availability impact. The vulnerability requires the user to navigate into or below the malicious directory and have Oh My Posh render the prompt, which occurs on the next command after changing directories.
Summary
Oh My Posh uses the Go text/template engine to render the resolved path string for the shell prompt. The path is composed from raw folder names taken from the filesystem, which are then passed to template.Render with a function map that includes a 'cmd' function capable of executing arbitrary OS commands. If a directory name contains Go template syntax, it is evaluated during prompt rendering, resulting in arbitrary command execution as the user. This affects all path styles and the default configuration. The vulnerability arises from re-parsing the composed path as a template after inserting untrusted folder names. A proof of concept demonstrates command execution by placing template expressions in directory names. The vulnerability is tracked as CVE-2026-73505 with a CVSS 3.1 score of 7.8 (high severity).
Weaknesses
References
- github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq (opens in a new tab)
- github.com/JanDeDobbeleer/oh-my-posh/commit/88ddbe0b0a4dd13cc345996108c9869493f2c690 (opens in a new tab)
- github.com/JanDeDobbeleer/oh-my-posh (opens in a new tab)
- github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1 (opens in a new tab)
- github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.36.0 (opens in a new tab)