CVE-2026-73506

Oh My Posh versions prior to 29.35.1 contain a terminal injection vulnerability in how the tool renders prompts from environment-derived data. The tool pulls directory names, Git commit subjects, author information, and remote URLs—data of wildly varying provenance—and renders them to the terminal stream without stripping control characters. An attacker can embed CSI sequences or other C0/C1 control codes into a directory name or commit message; when Oh My Posh displays the prompt, these sequences execute as terminal commands rather than displaying as literal text. This isn't theoretical: a directory named `$(printf '\e]2;pwned\a')` or a commit subject containing escape sequences will manipulate the terminal screen or corrupt clipboard content. The vulnerability exposes a design failure rather than an isolated coding mistake. Oh My Posh sits between your terminal emulator (which trusts applications to sanitize output) and data sources you don't fully control (repositories cloned from strangers, directories created by collaborators, CI artifacts with external metadata). The tool assumed environment data was inherently trustworthy—an assumption that held in isolated local workflows but breaks in modern development where you constantly navigate content from untrusted sources. The fix in 29.35.1 strips C0 and C1 control characters from rendered output, which is correct and low-overhead, but the deeper lesson is that environment-derived data should be treated as untrusted input by default. The CVSS 6.1 score and low EPSS don't capture the structural risk. This tool runs on every shell prompt across millions of developer workstations and CI pipelines. The blast radius includes credential exposure on developer machines, SSH sessions, cloud CLI contexts, and any pipeline where the prompt renders during debugging. The threat model here isn't

Reviewed through automated stages and approved by a human before publication.