Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-73506— Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data

CVSS 6.1 · Medium EPSS 0.13% · P3

Affected Version Matrix 1

VendorProductVersion RangeStatus
JanDeDobbeleeroh-my-posh< 29.35.1affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-73506

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data
Source: CVE Program / CVE List V5
Vulnerability Description
Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune) in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and RawUpstreamURL, without removing C0/C1 terminal control characters such as ESC, BEL, CSI, and OSC, allowing terminal escape sequence injection during prompt rendering that could overwrite the clipboard, spoof the prompt or screen, manipulate the window title, or disrupt the terminal. This issue is fixed in version 29.35.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
转义、元或控制序列转义处理不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Jan De Dobbeleer Oh My Posh 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Jan De Dobbeleer Oh My Posh是Jan De Dobbeleer个人开发者的一款命令行提示符美化工具。 Jan De Dobbeleer Oh My Posh 29.35.1之前版本存在输入验证错误漏洞，该漏洞源于src/terminal/writer.go中的write(s rune)函数在输出攻击者控制的当前目录名和Git元数据时未移除C0/C1终端控制字符，导致终端转义序列注入，可能覆盖剪贴板、伪造提示符或屏幕、操纵窗口标题或中断终端。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
JanDeDobbeleeroh-my-posh < 29.35.1 -

II. Public POCs for CVE-2026-73506

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-73506

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-73506 (2)

Vendor Advisories for CVE-2026-73506 (1)

Vendor Pages for CVE-2026-73506 (1)

IV. Related Vulnerabilities

Same product: oh-my-posh
Same vendor: JanDeDobbeleer
Same weakness: CWE-150

V. Comments for CVE-2026-73506

No comments yet

Leave a comment