CVE-2026-73506

MEDIUM 6.1

Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data

CVSS Score

6.1

EPSS Score

0.0%

EPSS Percentile

0th

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune) in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and RawUpstreamURL, without removing C0/C1 terminal control characters such as ESC, BEL, CSI, and OSC, allowing terminal escape sequence injection during prompt rendering that could overwrite the clipboard, spoof the prompt or screen, manipulate the window title, or disrupt the terminal. This issue is fixed in version 29.35.1.

CWE	CWE-150
Vendor	jandedobbeleer
Product	oh-my-posh
Published	Aug 13, 2026

Stay Ahead of the Next One

Get instant alerts for jandedobbeleer oh-my-posh

Be the first to know when new medium vulnerabilities affecting jandedobbeleer oh-my-posh are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Affected Versions

JanDeDobbeleer / oh-my-posh

< 29.35.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-fwjx-9p69-h25h github.com: https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711 github.com: https://github.com/JanDeDobbeleer/oh-my-posh/commit/edcf3c88f3fb582e84358b385c49d33d04c04224 github.com: https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1