Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-73505: Oh My Posh: Malicious directory names can run commands
CVE-2026-73505 · published 2 months ago
Summary
Oh My Posh, a prompt renderer, was vulnerable to malicious directory names that could run arbitrary commands as the current user. This has been fixed in version 29.35.1. To stay secure, update to the latest version of Oh My Posh.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| jandedobbeleer | oh-my-posh | < 29.35.1 |
Original advisory text
Oh My Posh: Arbitrary command execution via template injection in the path segment
Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1.
References
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-94Code Injection
CWE-1336Improper Neutralization of Special Elements Used in a Template Engine
Timeline
Published13 Aug 2026
Updated29 Oct 2026
First seen13 Aug 2026
Track software like this
Free during beta