JanDeDobbeleer Oh My Posh up to 29.35.0 Path Segment src/segments/path.go setStyle code injection

Summaryinfo

A vulnerability identified as problematic has been detected in JanDeDobbeleer Oh My Posh up to 29.35.0. Affected by this issue is the function setStyle of the file src/segments/path.go of the component Path Segment. Performing a manipulation results in code injection. This vulnerability was named CVE-2026-73505. The attack needs to be approached locally. There is no available exploit.

Detailsinfo

A vulnerability was found in JanDeDobbeleer Oh My Posh up to 29.35.0. It has been classified as problematic. This affects the function setStyle of the file src/segments/path.go of the component Path Segment. The manipulation with an unknown input leads to a code injection vulnerability. CWE is classifying the issue as CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-73505 since 08/12/2026. The exploitability is told to be easy. Attacking locally is a requirement. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1059 according to MITRE ATT&CK.

Upgrading to version 29.35.1 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• JanDeDobbeleer

Name

• Oh My Posh

Version

• 29.0
• 29.1
• 29.2
• 29.3
• 29.4
• 29.5
• 29.6
• 29.7
• 29.8
• 29.9
• 29.10
• 29.11
• 29.12
• 29.13
• 29.14
• 29.15
• 29.16
• 29.17
• 29.18
• 29.19
• 29.20
• 29.21
• 29.22
• 29.23
• 29.24
• 29.25
• 29.26
• 29.27
• 29.28
• 29.29
• 29.30
• 29.31
• 29.32
• 29.33
• 29.34
• 29.35.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion