CVE-2026-73506
CVE-2026-73506: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium6.1
Medium [CVE-2026-73506] Terminal escape sequence injection via unsanitized prompt data
CVE-2026-73506Source published Source updated
Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune) in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit. Subject, Commit. Author.Name, Commit. Author.Email, and RawUpstreamURL, without removing C0/C1 terminal control characters such as ESC, BEL, CSI, and OSC, allowing terminal escape sequence injection during prompt rendering that could overwrite the clipboard, spoof the prompt or screen, manipulate the window title, or disrupt the terminal. This issue is fixed in version 29.35.1. A flaw was found in Oh My Posh, a customizable terminal prompt renderer. Oh My Posh is not shipped in any Red Hat product. It is available in Fedora as a community package. Red Hat…
- Affected products in this advisory
- No product details extracted. Check the source bulletin.
- Source-reported affected versions
- < 29.35.1
- Source-reported fixed versions
- 29.35.1
- Mitigation guidance
- Update to Oh My Posh version 29.35.1 or later. As a workaround, avoid navigating to untrusted git repositories or directories with untrusted names while using Oh My Posh as your prompt renderer.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.