Threats affecting pkg:golang/github.com/jandedobbeleer/oh-my-posh

CVE-2026-73506 is a vulnerability in JanDeDobbeleer's oh-my-posh prompt renderer prior to version 29.35.1. It involves improper neutralization of terminal control characters in user-controllable data such as current directory names and Git metadata. This flaw allows injection of terminal escape sequences that can manipulate the terminal display, overwrite the clipboard, spoof prompts, or disrupt terminal operation. The issue is fixed in version 29.35.1.

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1.

Oh My Posh versions prior to 29.35.1 contain a vulnerability where the resolved path string is re-rendered as a Go template, evaluating any template expressions in folder names. This allows arbitrary command execution as the current user when the shell prompt renders inside or below a directory with a crafted name. The default configuration is affected, and the issue impacts multiple path styles.

Oh My Posh versions prior to 29.35.1 allow terminal escape sequence injection via unsanitized prompt segment data. This occurs because dynamic strings such as directory names and Git commit metadata are rendered into the prompt without neutralizing raw terminal control characters. An attacker controlling these values can inject ANSI/OSC escape sequences that the victim's terminal executes on every prompt render, enabling clipboard hijacking, prompt spoofing, window-title manipulation, and denial of service.