Oh My Posh renders dynamic, potentially attacker-controlled strings (e.g., current directory name, Git commit metadata) into the terminal prompt without neutralizing raw terminal control characters such as ESC, BEL, CSI, and OSC sequences. These control characters are emitted verbatim in the prompt output, allowing an attacker who controls these values to inject ANSI/OSC escape sequences. These sequences are executed by the victim's terminal on every prompt render. Verified attacker-controlled sources include directory names and Git commit metadata fields (subject, author, upstream URL). The impact includes clipboard hijacking via OSC 52, prompt and screen spoofing, window-title manipulation, and terminal denial of service. The vulnerability affects Oh My Posh versions before 29.35.1. The suggested remediation is to neutralize control characters in untrusted segment data before rendering, extending existing ANSI trimming to prompt segments.

The injected terminal escape sequences are executed locally on the victim's terminal each time the prompt renders. This can enable clipboard hijacking (inserting attacker-controlled content into the clipboard), spoofing of the prompt or terminal screen, manipulation of the terminal window title, and denial of service conditions in the terminal emulator. The attack requires the victim to render the prompt with attacker-controlled data, such as changing into a directory with a malicious name or viewing Git commit metadata crafted by an attacker. The impact is limited to local terminal effects and depends on the terminal emulator's support for these escape sequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The suggested fix is to neutralize C0/C1 control characters in untrusted prompt segment data before it is rendered to the terminal, specifically in the path segment (directory names) and Git segment (commit subject, author, upstream URL). Existing ANSI trimming applied to console titles should be extended to prompt body segments. Filtering control runes in the write function would provide defense in depth. Until an official fix is released, users should avoid rendering untrusted data in their prompt segments or sanitize such data manually.