CVE-2026-73506
Received Received - Intake

Oh My Posh Terminal Escape Sequence Injection

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description
Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune) in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and RawUpstreamURL, without removing C0/C1 terminal control characters such as ESC, BEL, CSI, and OSC, allowing terminal escape sequence injection during prompt rendering that could overwrite the clipboard, spoof the prompt or screen, manipulate the window title, or disrupt the terminal. This issue is fixed in version 29.35.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73506
EUVD
EUVD-2026-58081

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
jan_de_dobbeleer oh_my_posh to 29.35.1 (exc)
jan_de_dobbeleer oh_my_posh to 29.35.0 (inc)
oh_my_posh oh_my_posh 29.35.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-150 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73506 is a terminal escape sequence injection vulnerability in Oh My Posh, a prompt theme engine. It occurs because Oh My Posh renders attacker-controlled strings like directory names or Git metadata into the prompt without sanitizing terminal control characters such as ESC, BEL, CSI, and OSC. This allows attackers to inject malicious escape sequences that manipulate the terminal, clipboard, or screen when the prompt renders.

Detection Guidance

Check Oh My Posh version with 'oh-my-posh version'. If version is <=29.35.0, it is vulnerable. Inspect directory names and Git metadata for unusual escape sequences. Monitor terminal behavior for unexpected changes like clipboard manipulation or prompt spoofing.

Impact Analysis

This vulnerability could allow attackers to overwrite your clipboard, spoof the prompt or screen, manipulate the window title, or disrupt the terminal. For example, a malicious Git commit subject or directory name could execute terminal commands when the prompt renders, potentially leading to data theft or system compromise.

Mitigation Strategies

Upgrade Oh My Posh to version 29.35.1 or later immediately. Avoid using untrusted directory names or Git metadata in prompts. Review and sanitize any custom templates or configurations for dangerous functions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73506. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart