Bash-it up to 3.2.0 Python virtualenv prompt segment __prompt-command requires-python injection

Summaryinfo

A vulnerability was found in Bash-it up to 3.2.0. It has been declared as problematic. The affected element is the function __prompt-command of the component Python virtualenv prompt segment. The manipulation of the argument requires-python results in injection. This vulnerability was named CVE-2026-73036. The attack needs to be approached locally. There is no available exploit.

Detailsinfo

A vulnerability classified as problematic has been found in Bash-it up to 3.2.0. Affected is the function __prompt-command of the component Python virtualenv prompt segment. The manipulation of the argument requires-python with an unknown input leads to a injection vulnerability. CWE is classifying the issue as CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to inject arbitrary terminal control sequences by embedding escape sequences in the requires-python field of a pyproject.toml file. When a user navigates into a directory containing a maliciously crafted pyproject.toml, the unfiltered field value is read via awk and concatenated directly into PS1 through __prompt-command without stripping control characters, causing injected OSC or CSI sequences to be written to and interpreted by the terminal emulator on every prompt render.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-73036 since 08/10/2026. The exploitability is told to be easy. The attack needs to be approached locally. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1055.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Bash-it

Version

• 3.0
• 3.1
• 3.2.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion