Bash-it version 3.2.0 has a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment. This flaw allows local attackers to inject arbitrary terminal control sequences by embedding escape sequences in the requires-python field of a pyproject.toml file. When a user enters a directory with a crafted pyproject.toml, the unfiltered field value is read and directly concatenated into the shell prompt without filtering control characters, causing the terminal emulator to interpret injected sequences on every prompt render. This vulnerability has a medium severity rating with a CVSS score of 4.4.