A AegiFlow
HIGHCVSS 7.8EPSS 0.2%

CVE-2026-73505

CVE-2026-73505 updated by NVD

Published
2026-07-24
Modified
2026-09-11
EPSS percentile
5%
Sources
github-advisory, nvd

Summary

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1.

Affected packages

EcosystemPackageAffected versionsFixed versions
Gogithub.com/jandedobbeleer/oh-my-posh29.35.1

Remediation: Upgrade to 29.35.1 or later.

References

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.