Oh My Posh: Arbitrary command execution via template injection in the path segment

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-73505 · Microsoft / collected KEV context

GHSA-6xj8-qv9j-xcjq

GO-2026-6108

cve-program · CVE-2026-73505

• https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq
• https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711
• https://github.com/JanDeDobbeleer/oh-my-posh/commit/88ddbe0b0a4dd13cc345996108c9869493f2c690
• https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1

nvd · CVE-2026-73505

• https://github.com/JanDeDobbeleer/oh-my-posh/commit/88ddbe0b0a4dd13cc345996108c9869493f2c690
• https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711
• https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1
• https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq

osv · GHSA-6xj8-qv9j-xcjq

• https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq
• https://github.com/JanDeDobbeleer/oh-my-posh/commit/88ddbe0b0a4dd13cc345996108c9869493f2c690
• https://github.com/JanDeDobbeleer/oh-my-posh
• https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1
• https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.36.0

osv · GO-2026-6108

• https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq
• https://github.com/JanDeDobbeleer/oh-my-posh/commit/88ddbe0b0a4dd13cc345996108c9869493f2c690
• https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1
• https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.36.0

No related operational record is retained in the current change model.