CVE-2026-73506
Description
A flaw was found in Oh My Posh, a customizable terminal prompt renderer. The software failed to properly sanitize attacker-controlled data, such as current directory names and Git metadata, before displaying it in the terminal. This oversight allows for terminal escape sequence injection, enabling a remote attacker to manipulate the terminal. Consequences include the potential to overwrite the clipboard, spoof the prompt or screen, alter the window title, or disrupt the terminal's normal operation.
Statement
Oh My Posh is not shipped in any Red Hat product. It is available in Fedora as a community package.
Mitigation
Update to Oh My Posh version 29.35.1 or later. As a workaround, avoid navigating to untrusted git repositories or directories with untrusted names while using Oh My Posh as your prompt renderer.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Unexpected State
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
