Threats Tagged 'cve-2026-73505'

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1.

Oh My Posh versions prior to 29.35.1 contain a vulnerability where the resolved path string is re-rendered as a Go template, evaluating any template expressions in folder names. This allows arbitrary command execution as the current user when the shell prompt renders inside or below a directory with a crafted name. The default configuration is affected, and the issue impacts multiple path styles.