Threats Tagged 'ghsa-6xj8-qv9j-xcjq'

Oh My Posh versions prior to 29.35.1 contain a vulnerability where the resolved path string is re-rendered as a Go template, evaluating any template expressions in folder names. This allows arbitrary command execution as the current user when the shell prompt renders inside or below a directory with a crafted name. The default configuration is affected, and the issue impacts multiple path styles.