CVE-2026-73505

Katalog CVE

CVSS 7.8 · High EPSS 0,21%

Kerentanan Improper Control of Generation of Code ('Code Injection'). Skor CVSS 3.1 7.8 (High) menurut github.com.

Deskripsi (NVD)

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1.

Rincian

Terbit di NVD

13 Agustus 2026

Terakhir diubah

9 September 2026

Status NVD

Deferred

CVSS 3.1

7.8 (High), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,7% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/JanDeDobbeleer/oh-my-posh/commit/88ddbe0b0a4dd13cc345996108c9869493f2c690
• https://github.com/JanDeDobbeleer/oh-my-posh/pull/7711
• https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1
• https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq