GO-2026-6111 Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data in github.com/jandedobbeleer/oh-my-posh

Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data in github.com/jandedobbeleer/oh-my-posh...

PT-2026-80357

Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data in github.com/jandedobbeleer/oh-my-posh...

CVE-2026-73506 Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, writes rune in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and...

CVE-2026-73506

Oh My Posh is vulnerable to terminal escape sequence injection in prompt rendering. In versions prior to 29.35.1, the function write(s rune) could emit attacker-controlled data (current directory names and Git metadata, including Commit.Subject, Commit.Author.Name/Email, RawUpstreamURL) without r...