{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73505", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-12T19:00:33.736Z", "datePublished": "2026-08-13T14:21:57.231Z", "dateUpdated": "2026-08-13T15:18:34.824Z"}, "containers": {"cna": {"title": "Oh My Posh: Arbitrary command execution via template injection in the path segment", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1336", "lang": "en", "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq"}, {"name": "https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711", "tags": ["x_refsource_MISC"], "url": "https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711"}, {"name": "https://github.com/JanDeDobbeleer/oh-my-posh/commit/88ddbe0b0a4dd13cc345996108c9869493f2c690", "tags": ["x_refsource_MISC"], "url": "https://github.com/JanDeDobbeleer/oh-my-posh/commit/88ddbe0b0a4dd13cc345996108c9869493f2c690"}, {"name": "https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1"}], "affected": [{"vendor": "JanDeDobbeleer", "product": "oh-my-posh", "versions": [{"version": "< 29.35.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-13T14:21:57.231Z"}, "descriptions": [{"lang": "en", "value": "Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1."}], "source": {"advisory": "GHSA-6xj8-qv9j-xcjq", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T15:18:06.808055Z", "id": "CVE-2026-73505", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T15:18:34.824Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-73505", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-13T15:18:06.808055Z"}}}], "references": [{"url": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T15:18:26.301Z"}}], "cna": {"title": "Oh My Posh: Arbitrary command execution via template injection in the path segment", "source": {"advisory": "GHSA-6xj8-qv9j-xcjq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "JanDeDobbeleer", "product": "oh-my-posh", "versions": [{"status": "affected", "version": "< 29.35.1"}]}], "references": [{"url": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq", "name": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711", "name": "https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/JanDeDobbeleer/oh-my-posh/commit/88ddbe0b0a4dd13cc345996108c9869493f2c690", "name": "https://github.com/JanDeDobbeleer/oh-my-posh/commit/88ddbe0b0a4dd13cc345996108c9869493f2c690", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1", "name": "https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1336", "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-13T14:21:57.231Z"}}}, "cveMetadata": {"cveId": "CVE-2026-73505", "state": "PUBLISHED", "dateUpdated": "2026-08-13T15:18:34.824Z", "dateReserved": "2026-08-12T19:00:33.736Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-13T14:21:57.231Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "oh-my-posh", "vendor": "JanDeDobbeleer", "versions": [{"status": "affected", "version": "< 29.35.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1."}], "id": "CVE-2026-73505", "lastModified": "2026-08-13T16:19:04.977", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73505", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-13T15:18:06.808055Z", "version": "2.0.3"}}]}, "published": "2026-08-13T15:20:16.943", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/JanDeDobbeleer/oh-my-posh/commit/88ddbe0b0a4dd13cc345996108c9869493f2c690"}, {"source": "security-advisories@github.com", "url": "https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711"}, {"source": "security-advisories@github.com", "url": "https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-1336"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/jandedobbeleer/oh-my-posh: Oh My Posh: Arbitrary command execution via template injection in directory names", "id": "2515399", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515399"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-78", "details": ["Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1.", "A flaw was found in Oh My Posh. A local attacker could craft a malicious directory name containing a Go template expression. When the prompt renders within this directory or its subdirectories, the embedded template expression could execute arbitrary operating system commands as the current user. This could lead to unauthorized command execution."], "mitigation": {"lang": "en:us", "value": "There is no mitigation for this flaw. Update to Oh My Posh version 29.35.1 or later."}, "name": "CVE-2026-73505", "public_date": "2026-08-13T14:21:57Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-73505\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-73505\nhttps://github.com/JanDeDobbeleer/oh-my-posh/commit/88ddbe0b0a4dd13cc345996108c9869493f2c690\nhttps://github.com/JanDeDobbeleer/oh-my-posh/pull/7711\nhttps://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1\nhttps://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq"], "statement": "Red Hat does not ship Oh My Posh in any supported products. The oh-my-posh package is available in Fedora and is maintained by the community.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,29.35.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "oh-my-posh", "source": "cna", "vendor": "JanDeDobbeleer"}, "product": "oh-my-posh", "vendor": "jandedobbeleer"}], "created": "2026-08-13T16:30:03.492269+00:00", "updated": "2026-08-15T02:30:16.741182+00:00", "vendors": ["jandedobbeleer", "jandedobbeleer$PRODUCT$oh-my-posh"]}