Vulnerability · Published Aug 11, 2026 · Assigned by VulnCheck

CVE-2026-73036Bash-it barbuk Theme 3.2.0 Terminal Escape Sequence Injection via pyproject.toml

Medium 4.4

In plain English

A medium-severity security flaw in Bash-it from Bash-it. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)4.4Medium

Exploit odds (30 days)0.2%top 92.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to inject arbitrary terminal control sequences by embedding escape sequences in the requires-python field of a pyproject.toml file. When a user navigates into a directory containing a maliciously crafted pyproject.toml, the unfiltered field value is read via awk and concatenated directly into PS1 through __prompt-command without stripping control characters, causing injected OSC or CSI sequences to be written to and interpreted by the terminal emulator on every prompt render.

Affected products (as reported)

Vendor	Product	Versions
Bash-it	Bash-it	0 – through 3.2.0

Weakness: CWE-150 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

Product Repository product
Patch Commit patch
GitHub Issue issue-tracking
Pull Request technical-description
https://www.vulncheck.com/advisories/bash-it-barbuk-theme-terminal-escape-sequence-injection-via-pyproject-toml third-party-advisory