jandedobbeleer vulnerabilities

Products

• github.com/jandedobbeleer/oh-my-posh 2

Latest jandedobbeleer CVEs

Newest publication first

1. CVE-2026-73506 Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data

   Published 2026-08-13

   Medium·CVSS 6.1 EPSS 0.18%

   Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune) in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Em...

2. CVE-2026-73505 Oh My Posh: Arbitrary command execution via template injection in the path segment

   Published 2026-08-13

   High·CVSS 7.8 EPSS 0.21%

   Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controll...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.