Threats affecting pkg:github/bash-it/bash-it

Bash-it version 3.2.0 and earlier contain a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment. This flaw allows local attackers to inject arbitrary terminal control sequences by embedding escape sequences in the requires-python field of a pyproject.toml file. When a user enters a directory with a malicious pyproject.toml, the crafted field value is read and concatenated directly into the shell prompt without filtering control characters, causing the terminal emulator to interpret injected sequences on every prompt render.