Description

Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune) in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and RawUpstreamURL, without removing C0/C1 terminal control characters such as ESC, BEL, CSI, and OSC, allowing terminal escape sequence injection during prompt rendering that could overwrite the clipboard, spoof the prompt or screen, manipulate the window title, or disrupt the terminal. This issue is fixed in version 29.35.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-13T15:20:17.133Z",
  "pubdate": "2026-08-13T15:20:17.133Z",
  "executiveSummary": "An input sanitization vulnerability exists in Oh My Posh prior to version 29.35.1, specifically within the terminal writing routines that process dynamic environment data. The vulnerability involves the failure to strip C0 and C1 terminal control characters, including ESC, BEL, CSI, and OSC sequences, from rendered dynamic strings.\nThe flaw allows an attacker who controls the current working directory name or Git repository metadata to inject arbitrary terminal escape sequences into the prompt rendering process. When the affected prompt renderer evaluates directories or Git metadata containing malicious control characters, the terminal emulator interprets these sequences as administrative commands rather than raw text.\nSuccessful exploitation can lead to severe security impacts, including terminal screen spoofing, arbitrary window title manipulation, clipboard overwriting, and overall terminal session disruption. The risk is elevated because prompts are rendered frequently in interactive shells, automatically processing untrusted inputs encountered during daily file system navigation or repository cloning.\nThe vulnerability affects Oh My Posh versions prior to 29.35.1. Exploitation requires the victim to navigate to a maliciously named directory or interact with a Git repository containing crafted metadata. No specialized authentication or high privileges are required beyond the ability to create or influence file paths and Git attributes.",
  "technicalDetails": "The vulnerability resides in the write(s rune) function located in src/terminal/writer.go within the Oh My Posh codebase. The root cause of the issue is the direct output of untrusted, attacker-controlled data streams without prior validation, sanitization, or filtering of terminal control characters. Specifically, strings representing the current directory names and Git metadata—such as Commit.Subject, Commit.Author.Name, Commit.Author.Email, and RawUpstreamURL—are emitted directly to the terminal output stream.\nDuring the prompt rendering phase, Oh My Posh fetches these metadata fields and passes them to the vulnerable write(s rune) function. Because the function fails to strip C0 and C1 control characters—such as Escape (ESC), Bell (BEL), Control Sequence Introducer (CSI), and Operating System Command (OSC) sequences—these characters are transmitted raw to the underlying terminal emulator.\nThe attack flow proceeds as follows: First, an attacker establishes a malicious context by creating a directory with a specific name or configuring a Git repository with malicious metadata containing raw escape sequences (e.g., OSC strings designed to modify the clipboard or CSI sequences designed to manipulate cursor positions). Second, the victim navigates into the vulnerable directory or opens the repository using a shell configured with Oh My Posh. Third, Oh My Posh evaluates the prompt segments, capturing the directory name or Git metadata. Fourth, the application calls the vulnerable write(s rune) function in src/terminal/writer.go, sending the raw, unsanitized string to stdout. Fifth, the terminal emulator parses the incoming data stream, executing the embedded escape sequences.\nThe affected component is the terminal writer subsystem of Oh My Posh across versions prior to 29.35.1. The attack vector is local, exploiting environment data and file system artifacts rather than network protocols. Post-exploitation impacts include spoofing the command prompt to deceive users into executing malicious commands, altering terminal window titles to mislead operators, modifying the system clipboard with malicious payloads, and causing arbitrary terminal disruptions."
}