Description

Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to inject arbitrary terminal control sequences by embedding escape sequences in the requires-python field of a pyproject.toml file. When a user navigates into a directory containing a maliciously crafted pyproject.toml, the unfiltered field value is read via awk and concatenated directly into PS1 through __prompt-command without stripping control characters, causing injected OSC or CSI sequences to be written to and interpreted by the terminal emulator on every prompt render.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-08-11T20:18:46.617Z",
  "pubdate": "2026-08-11T20:18:46.617Z",
  "executiveSummary": "Bash-it version 3.2.0 contains a terminal escape sequence injection vulnerability within the barbuk theme's Python virtualenv prompt segment. This vulnerability allows local attackers to inject arbitrary terminal control sequences by embedding malicious payloads into the requires-python field of a pyproject.toml file.\nThe primary impact of this flaw is the execution of arbitrary terminal control sequences in the context of the victim's terminal emulator whenever they navigate into a directory containing the crafted configuration file.\nThe affected product is Bash-it version 3.2.0, specifically impacting users utilizing the barbuk theme.\nThe risk implications include potential terminal manipulation, spoofing of prompt displays, or execution of terminal-based attacks depending on the capabilities of the terminal emulator interpreting the injected sequences.\nAttacker capabilities are restricted to local execution vectors where they can influence or control the contents of a pyproject.toml file within a directory targeted by a victim.\nExploitation requires the victim to navigate into a directory containing the maliciously crafted pyproject.toml file while using the vulnerable barbuk theme, which triggers the automated prompt rendering mechanism.",
  "technicalDetails": "The vulnerability resides in the barbuk theme's Python virtualenv prompt segment of Bash-it version 3.2.0. The root cause is the lack of input sanitization and failure to strip control characters when processing dynamic data intended for the primary prompt string (PS1).\nSpecifically, when a user navigates into a directory, the prompt segment reads the requires-python field from a pyproject.toml file using awk. This extracted string is then concatenated directly into the PS1 variable through the __prompt-command function without validation or stripping of terminal control characters.\nThe attack flow proceeds as follows: First, an attacker crafts a malicious pyproject.toml file containing arbitrary Operating System Command (OSC) or Control Sequence Introducer (CSI) escape sequences embedded within the requires-python field. Second, the victim places or clones this file locally and navigates into the containing directory using a shell configured with the barbuk theme. Third, the prompt rendering logic executes, invoking awk to read the unfiltered requires-python field. Fourth, the raw string containing the malicious escape sequences is concatenated directly into the PS1 variable via __prompt-command. Finally, upon every prompt render, the terminal emulator interprets the injected OSC or CSI sequences written to the output stream.\nThe vulnerable component is the barbuk theme prompt segment interacting with __prompt-command. Affected versions include Bash-it 3.2.0. Authentication and network exposure are not applicable as this is a local file-parsing vulnerability requiring no network access or remote authentication. Privilege requirements are minimal, requiring only local file creation capabilities and standard user interaction via shell navigation."
}