CVE-2026-73036

Received Received - Intake

Bash-it Terminal Escape Sequence Injection in Barbuk Theme

Publication date: 2026-08-11

Last updated on: 2026-08-12

Assigner: VulnCheck

Description

Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to inject arbitrary terminal control sequences by embedding escape sequences in the requires-python field of a pyproject.toml file. When a user navigates into a directory containing a maliciously crafted pyproject.toml, the unfiltered field value is read via awk and concatenated directly into PS1 through __prompt-command without stripping control characters, causing injected OSC or CSI sequences to be written to and interpreted by the terminal emulator on every prompt render.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-12

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-73036

EUVD

EUVD-2026-56927

Affected Vendors & Products

Vendor	Product	Version / Range
bash-it	bash-it	3.2.0
bash-it	bash-it	to 3.2.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-150	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-73036 is a terminal escape sequence injection vulnerability in Bash-it 3.2.0's barbuk theme. It occurs when a malicious pyproject.toml file contains unfiltered escape sequences in the requires-python field. When a user navigates into the directory, the unfiltered value is read via awk and added to the shell prompt (PS1) without stripping control characters. This allows attackers to inject OSC or CSI sequences that the terminal emulator interprets, potentially manipulating terminal behavior or executing unintended commands.

Detection Guidance

Check for directories containing maliciously crafted pyproject.toml files with unfiltered requires-python fields. Inspect Bash-it themes for the barbuk theme and python_venv prompt segment. Use grep to search for escape sequences in PS1 or prompt commands.

Impact Analysis

This vulnerability could allow local attackers to manipulate your terminal emulator by injecting escape sequences. This might change your terminal title, alter displayed text, or execute unintended commands when you navigate into a directory containing a maliciously crafted pyproject.toml file. The impact is limited to local users who have access to create files in directories you visit.

Compliance Impact

This vulnerability does not directly impact GDPR or HIPAA compliance as it is a local terminal escape sequence injection issue affecting Bash-it's prompt rendering. Compliance risks would only arise if attackers exploited this to capture sensitive data displayed in terminals or manipulate terminal sessions during regulated activities.

Mitigation Strategies

Update Bash-it to the latest version. Remove or sanitize any pyproject.toml files with untrusted requires-python fields. Strip control characters from prompt segments by modifying __prompt-command and __python_venv_prompt functions.

Hi! I’m here to help you understand CVE-2026-73036. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70