Vulnerability · Published Aug 13, 2026 · Assigned by GitHub_M
CVE-2026-73506Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data
Medium 6.1
In plain English
A medium-severity security flaw in oh-my-posh from JanDeDobbeleer. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune) in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and RawUpstreamURL, without removing C0/C1 terminal control characters such as ESC, BEL, CSI, and OSC, allowing terminal escape sequence injection during prompt rendering that could overwrite the clipboard, spoof the prompt or screen, manipulate the window title, or disrupt the terminal. This issue is fixed in version 29.35.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/jandedobbeleer/oh-my-posh | 29.35.1 | GHSA-fwjx-9p69-h25h |
| Go | github.com/jandedobbeleer/oh-my-posh | 29.35.1+incompatible | GO-2026-6111 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| JanDeDobbeleer | oh-my-posh | < 29.35.1 |
Weakness: CWE-150 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
References
- https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-fwjx-9p69-h25h x_refsource_CONFIRM
- https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711 x_refsource_MISC
- https://github.com/JanDeDobbeleer/oh-my-posh/commit/edcf3c88f3fb582e84358b385c49d33d04c04224 x_refsource_MISC
- https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1 x_refsource_MISC
- https://github.com/Budibase/budibase/security/advisories/GHSA-fcrw-f7gg-6g9f exploit