High [CVE-2026-73505] Arbitrary command execution via template injection in directory names
This high-severity Red Hat Linux advisory covers CVE-2026-73505.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.
Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1.
A flaw was found in Oh My Posh. This could lead to unauthorized command execution.
Red Hat does not ship Oh My Posh in any supported products. The oh-my-posh package is available in Fedora and is maintained by the community.
Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-78.
- < 29.35.1
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
- 29.35.1
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation checklist
- There is no mitigation for this flaw. Update to Oh My Posh version 29.35.1 or later.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.