CVE-2026-73505

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73505", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-12T19:00:33.736Z", "datePublished": "2026-08-13T14:21:57.231Z", "dateUpdated": "2026-08-13T15:18:34.824Z"}, "containers": {"cna": {"title": "Oh My Posh: Arbitrary command execution via template injection in the path segment", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1336", "lang": "en", "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq"}, {"name": "https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711", "tags": ["x_refsource_MISC"], "url": "https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711"}, {"name": "https://github.com/JanDeDobbeleer/oh-my-posh/commit/88ddbe0b0a4dd13cc345996108c9869493f2c690", "tags": ["x_refsource_MISC"], "url": "https://github.com/JanDeDobbeleer/oh-my-posh/commit/88ddbe0b0a4dd13cc345996108c9869493f2c690"}, {"name": "https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1"}], "affected": [{"vendor": "JanDeDobbeleer", "product": "oh-my-posh", "versions": [{"version": "< 29.35.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-13T14:21:57.231Z"}, "descriptions": [{"lang": "en", "value": "Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1."}], "source": {"advisory": "GHSA-6xj8-qv9j-xcjq", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T15:18:06.808055Z", "id": "CVE-2026-73505", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T15:18:34.824Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-73505", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-13T15:18:06.808055Z"}}}], "references": [{"url": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T15:18:26.301Z"}}], "cna": {"title": "Oh My Posh: Arbitrary command execution via template injection in the path segment", "source": {"advisory": "GHSA-6xj8-qv9j-xcjq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "JanDeDobbeleer", "product": "oh-my-posh", "versions": [{"status": "affected", "version": "< 29.35.1"}]}], "references": [{"url": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq", "name": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711", "name": "https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/JanDeDobbeleer/oh-my-posh/commit/88ddbe0b0a4dd13cc345996108c9869493f2c690", "name": "https://github.com/JanDeDobbeleer/oh-my-posh/commit/88ddbe0b0a4dd13cc345996108c9869493f2c690", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1", "name": "https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1336", "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-13T14:21:57.231Z"}}}, "cveMetadata": {"cveId": "CVE-2026-73505", "state": "PUBLISHED", "dateUpdated": "2026-08-13T15:18:34.824Z", "dateReserved": "2026-08-12T19:00:33.736Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-13T14:21:57.231Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "oh-my-posh", "vendor": "JanDeDobbeleer", "versions": [{"status": "affected", "version": "< 29.35.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1."}, {"lang": "es", "value": "Oh My Posh es el renderizador de prompt de shell/plataforma cruzada m\u00e1s personalizable y de baja latencia. Antes de la versi\u00f3n 29.35.1, la funci\u00f3n setStyle() en src/segments/path.go pasaba pt.Path, que incluye nombres de carpetas sin procesar, a template.Render, cuyo mapa de funciones expone cmd, por lo que un nombre de directorio controlado por el atacante que contenga una expresi\u00f3n de plantilla Go podr\u00eda ejecutar comandos arbitrarios del sistema operativo como el usuario actual cada vez que el prompt se renderizaba dentro de ese directorio o un descendiente. Este problema se ha corregido en la versi\u00f3n 29.35.1."}], "id": "CVE-2026-73505", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73505", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-13T15:18:06.808055Z", "version": "2.0.3"}}]}, "published": "2026-08-13T15:20:16.943", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/JanDeDobbeleer/oh-my-posh/commit/88ddbe0b0a4dd13cc345996108c9869493f2c690"}, {"source": "security-advisories@github.com", "url": "https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711"}, {"source": "security-advisories@github.com", "url": "https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-1336"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/jandedobbeleer/oh-my-posh: Oh My Posh: Arbitrary command execution via template injection in directory names", "id": "2515399", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515399"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-78", "details": ["Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1.", "A flaw was found in Oh My Posh. A local attacker could craft a malicious directory name containing a Go template expression. When the prompt renders within this directory or its subdirectories, the embedded template expression could execute arbitrary operating system commands as the current user. This could lead to unauthorized command execution."], "mitigation": {"lang": "en:us", "value": "There is no mitigation for this flaw. Update to Oh My Posh version 29.35.1 or later."}, "name": "CVE-2026-73505", "public_date": "2026-08-13T14:21:57Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-73505\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-73505\nhttps://github.com/JanDeDobbeleer/oh-my-posh/commit/88ddbe0b0a4dd13cc345996108c9869493f2c690\nhttps://github.com/JanDeDobbeleer/oh-my-posh/pull/7711\nhttps://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1\nhttps://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq"], "statement": "Red Hat does not ship Oh My Posh in any supported products. The oh-my-posh package is available in Fedora and is maintained by the community.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,29.35.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "oh-my-posh", "source": "cna", "vendor": "JanDeDobbeleer"}, "product": "oh-my-posh", "vendor": "jandedobbeleer"}], "created": "2026-08-13T16:30:03.492269+00:00", "updated": "2026-08-15T02:30:16.741182+00:00", "vendors": ["jandedobbeleer", "jandedobbeleer$PRODUCT$oh-my-posh"]}