CVE-2026-73505: Oh My Posh: Arbitrary command execution via template injection in the path segment
Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oh My Poshto a version that resolves this vulnerability.Fixed in 29.35.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73505?
The severity of CVE-2026-73505 is high with a score of 7.8.
What type of vulnerability is CVE-2026-73505?
CVE-2026-73505 is categorized as a code injection vulnerability.
How do I fix CVE-2026-73505?
To fix CVE-2026-73505, upgrade to Oh My Posh version 29.35.1 or later.
What is the impact of CVE-2026-73505?
CVE-2026-73505 allows for arbitrary command execution due to template injection via attacker-controlled directory names.
Which software is affected by CVE-2026-73505?
CVE-2026-73505 affects Oh My Posh prior to version 29.35.1.