CVE-2026-73506
Last modified
CVE-2026-73506 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune) in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and RawUpstreamURL, without removing C0/C1 terminal control characters such as ESC, BEL, CSI, and OSC, allowing terminal escape sequence injection during prompt rendering that could overwrite the clipboard, spoof the prompt or screen, manipulate the window title, or disrupt the terminal. EPSS estimates a 0.13% chance of exploitation in the next 30 days.
Description
Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune) in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and RawUpstreamURL, without removing C0/C1 terminal control characters such as ESC, BEL, CSI, and OSC, allowing terminal escape sequence injection during prompt rendering that could overwrite the clipboard, spoof the prompt or screen, manipulate the window title, or disrupt the terminal. This issue is fixed in version 29.35.1.
Metrics
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| JanDeDobbeleer | oh-my-posh | < 29.35.1 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-73506?
How severe is CVE-2026-73506?
How do I fix CVE-2026-73506?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-73499etcd is a distributed key-value store for the data of a dist…7.1
- CVE-2026-7350Use after free in WebMIDI in Google Chrome prior to 147.0.77…8.3
- CVE-2026-73500etcd is a distributed key-value store for the data of a dist…8.7
- CVE-2026-73501kin-openapi is a Go project for handling OpenAPI files. Prio…9.1
- CVE-2026-73502kin-openapi is a Go project for handling OpenAPI files. From…5.3
- CVE-2026-73505Oh My Posh is the most customisable and low-latency cross pl…7.8
- CVE-2026-73507Netty is an asynchronous, event-driven network application f…7.5
- CVE-2026-73508Netty is an asynchronous, event-driven network application f…5.3
- CVE-2026-73509OpenList a file list program that supports multiple storage.…7.6
- CVE-2026-7351Race in MHTML in Google Chrome prior to 147.0.7727.138 allow…3.1
- CVE-2026-73514The address_standardizer extension for PostGIS through 3.7.0…8.8
- CVE-2026-73515PostGIS before 3.7.0beta2 contains an out-of-bounds read vul…8.1
Are you affected by CVE-2026-73506?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST