Oh My Posh
Monthly
Terminal escape sequence injection in Oh My Posh prior to version 29.35.1 allows an attacker who controls a Git repository or filesystem directory name to silently execute arbitrary ANSI/OSC escape sequences in a victim's terminal on every prompt render, without any user action beyond navigating to the attacker-influenced directory. The `write(s rune)` function in `src/terminal/writer.go` emitted attacker-controlled content — including Git commit subjects, author names and emails, upstream URLs, and working directory path components — verbatim to the terminal output buffer without stripping C0/C1 control characters such as ESC (0x1b), BEL (0x07), CSI, and OSC sequences. A publicly available proof-of-concept demonstrates OSC 52 clipboard overwrite and OSC 0 window title hijacking; no public exploit identified as confirmed actively exploited per CISA KEV at time of analysis.
Template injection in Oh My Posh prior to 29.35.1 allows arbitrary operating system command execution as the victim user when the shell prompt renders inside a directory whose name contains a Go template expression. The `setStyle()` function in `src/segments/path.go` passes raw filesystem path components - including untrusted directory names - directly into `template.Render`, whose function map exposes a `cmd` helper that invokes `env.RunCommand`. A publicly available proof-of-concept demonstrates command execution and file writes across Linux, macOS, and Windows. No active exploitation is confirmed in CISA KEV, but the attack surface includes any developer who `cd`s into a maliciously named directory on a shared or attacker-influenced filesystem.
Terminal escape sequence injection in Oh My Posh prior to version 29.35.1 allows an attacker who controls a Git repository or filesystem directory name to silently execute arbitrary ANSI/OSC escape sequences in a victim's terminal on every prompt render, without any user action beyond navigating to the attacker-influenced directory. The `write(s rune)` function in `src/terminal/writer.go` emitted attacker-controlled content — including Git commit subjects, author names and emails, upstream URLs, and working directory path components — verbatim to the terminal output buffer without stripping C0/C1 control characters such as ESC (0x1b), BEL (0x07), CSI, and OSC sequences. A publicly available proof-of-concept demonstrates OSC 52 clipboard overwrite and OSC 0 window title hijacking; no public exploit identified as confirmed actively exploited per CISA KEV at time of analysis.
Template injection in Oh My Posh prior to 29.35.1 allows arbitrary operating system command execution as the victim user when the shell prompt renders inside a directory whose name contains a Go template expression. The `setStyle()` function in `src/segments/path.go` passes raw filesystem path components - including untrusted directory names - directly into `template.Render`, whose function map exposes a `cmd` helper that invokes `env.RunCommand`. A publicly available proof-of-concept demonstrates command execution and file writes across Linux, macOS, and Windows. No active exploitation is confirmed in CISA KEV, but the attack surface includes any developer who `cd`s into a maliciously named directory on a shared or attacker-influenced filesystem.