{"id":"CVE-2026-73505","sourceIdentifier":"security-advisories@github.com","published":"2026-08-13T15:20:16.943","lastModified":"2026-10-24T15:10:00.190","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1."},{"lang":"es","value":"Oh My Posh es el renderizador de prompt de shell/plataforma cruzada más personalizable y de baja latencia. Antes de la versión 29.35.1, la función setStyle() en src/segments/path.go pasaba pt.Path, que incluye nombres de carpetas sin procesar, a template.Render, cuyo mapa de funciones expone cmd, por lo que un nombre de directorio controlado por el atacante que contenga una expresión de plantilla Go podría ejecutar comandos arbitrarios del sistema operativo como el usuario actual cada vez que el prompt se renderizaba dentro de ese directorio o un descendiente. Este problema se ha corregido en la versión 29.35.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"JanDeDobbeleer","product":"oh-my-posh","versions":[{"version":"< 29.35.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-13T15:18:06.808055Z","id":"CVE-2026-73505","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-1336"}]}],"references":[{"url":"https://github.com/JanDeDobbeleer/oh-my-posh/commit/88ddbe0b0a4dd13cc345996108c9869493f2c690","source":"security-advisories@github.com"},{"url":"https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711","source":"security-advisories@github.com"},{"url":"https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1","source":"security-advisories@github.com"},{"url":"https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq","source":"security-advisories@github.com"},{"url":"https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}