CVE-2026-73505
HighCVSS 7.8Summary
Oh My Posh before version 29.35.1 has a vulnerability in the setStyle() function in src/segments/path.go, which passes pt.Path (including raw folder names) to template.Render, whose function map exposes cmd. An attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt renders inside that directory or a descendant.
Risk Assessment
The vulnerability allows arbitrary code execution in the user's context, potentially leading to system compromise or data theft.
Recommendation
Update Oh My Posh to version 29.35.1 or later, which contains the fix.
Original NVD description (English source)
Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1.