CVE-2026-73505 in Oh My Posh
Summary
by MITRE • 08/13/2026
Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability identified in Oh My Posh versions prior to 29.35.1 represents a critical command injection flaw within the path segment rendering functionality. This issue stems from improper input validation and sanitization in the setStyle() function located in src/segments/path.go, where directory paths containing user-controlled content are directly passed to the template rendering engine without adequate security measures. The vulnerability specifically affects the handling of pt.Path variables that contain raw folder names, which are then processed through template.Render function calls.
The technical exploitation occurs through a dangerous interaction between the Go templating system and user-provided path components. When an attacker creates a directory with a name containing Go template syntax such as {{.}} or other command execution expressions, these templates become executable within the context of the prompt rendering process. The function map exposed by template.Render includes cmd functionality, which provides direct access to operating system command execution capabilities. This design flaw allows attackers to inject malicious commands that execute with the privileges of the current user whenever the shell prompt renders within the affected directory structure.
The operational impact of this vulnerability extends beyond simple command execution, as it can be leveraged for persistent compromise of systems where Oh My Posh is actively used. Attackers can establish backdoors, exfiltrate data, or escalate privileges by placing specially crafted directory names in locations where the prompt will be displayed. The low-latency nature of Oh My Posh means that these commands execute immediately upon shell interaction, providing attackers with real-time control over affected systems. This vulnerability aligns with CWE-94, which describes improper control of generation of code, and specifically manifests as a code injection vulnerability in template processing.
The remediation implemented in version 29.35.1 addresses this issue through proper input sanitization and validation of path components before they are processed by the templating engine. This fix ensures that directory names containing potentially malicious template syntax are properly escaped or filtered, preventing their execution as commands. Organizations using Oh My Posh should immediately upgrade to version 29.35.1 or later to mitigate this risk, particularly in environments where untrusted users may have write access to file systems where the prompt is rendered.
From an ATT&CK perspective, this vulnerability maps to T1059.001 (Command and Scripting Interpreter: PowerShell) and T1068 (Exploitation for Privilege Escalation), as it enables arbitrary command execution and can be used to escalate privileges through direct system access. The vulnerability also demonstrates the importance of input validation in shell environments, as highlighted by ATT&CK's emphasis on preventing injection attacks that could compromise system integrity. Regular security audits should include verification of template processing functions and proper sanitization of user inputs in cross-platform applications.