Threat database

CVE-2026-73506 is a vulnerability in JanDeDobbeleer's oh-my-posh prompt renderer prior to version 29.35.1. It involves improper neutralization of terminal control characters in user-controllable data such as current directory names and Git metadata. This flaw allows injection of terminal escape sequences that can manipulate the terminal display, overwrite the clipboard, spoof prompts, or disrupt terminal operation. The issue is fixed in version 29.35.1.

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1.