Oh My Posh uses the Go text/template engine to render the resolved path string for the shell prompt. The path is composed from raw folder names taken from the filesystem, which are then passed to template.Render with a function map that includes a 'cmd' function capable of executing arbitrary OS commands. If a directory name contains Go template syntax, it is evaluated during prompt rendering, resulting in arbitrary command execution as the user. This affects all path styles and the default configuration. The vulnerability arises from re-parsing the composed path as a template after inserting untrusted folder names. A proof of concept demonstrates command execution by placing template expressions in directory names. The vulnerability is tracked as CVE-2026-73505 with a CVSS 3.1 score of 7.8 (high severity).

An attacker who can create or control directory names in the filesystem (e.g., via cloned repositories, extracted archives, network shares, or removable drives) can execute arbitrary commands as the victim user when the shell prompt renders inside or below those directories. This can lead to full compromise of the user's environment with high confidentiality, integrity, and availability impact. The vulnerability requires the user to navigate into or below the malicious directory and have Oh My Posh render the prompt, which occurs on the next command after changing directories.

A patch is available for this vulnerability. Users should upgrade Oh My Posh to version 29.35.1 or later. The suggested fix involves avoiding re-parsing the composed path as a template after inserting untrusted folder names, either by rendering configuration templates individually and concatenating results or by escaping template delimiters in folder names. Until patched, users should avoid navigating into directories with untrusted or attacker-controlled names that may contain template expressions.