Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-73506 · Microsoft / collected KEV context

GHSA-fwjx-9p69-h25h

GO-2026-6111

cve-program · CVE-2026-73506

• https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-fwjx-9p69-h25h
• https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711
• https://github.com/JanDeDobbeleer/oh-my-posh/commit/edcf3c88f3fb582e84358b385c49d33d04c04224
• https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1

nvd · CVE-2026-73506

• https://github.com/JanDeDobbeleer/oh-my-posh/commit/edcf3c88f3fb582e84358b385c49d33d04c04224
• https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711
• https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1
• https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-fwjx-9p69-h25h
• https://github.com/Budibase/budibase/security/advisories/GHSA-fcrw-f7gg-6g9f

osv · GHSA-fwjx-9p69-h25h

• https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-fwjx-9p69-h25h
• https://github.com/JanDeDobbeleer/oh-my-posh/commit/edcf3c88f3fb582e84358b385c49d33d04c04224
• https://github.com/JanDeDobbeleer/oh-my-posh
• https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1
• https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.36.0

osv · GO-2026-6111

• https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-fwjx-9p69-h25h
• https://github.com/JanDeDobbeleer/oh-my-posh/commit/edcf3c88f3fb582e84358b385c49d33d04c04224
• https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1
• https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.36.0

No related operational record is retained in the current change model.