CVE-2026-73036 Bash-it barbuk Theme 3.2.0 Terminal Escape Sequence Injection via pyproject.toml
Local attackers can inject terminal escape sequences via pyproject.toml to execute arbitrary commands when users navigate to malicious directories.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-73036?
CVE-2026-73036 is a medium-severity code injection vulnerability in Bash-it, published on 11 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to inject arbitrary terminal control sequences by embedding escape sequences in the requires-python field of a pyproject.toml file. When a user navigates into a directory containing a maliciously crafted pyproject.toml, the unfiltered field value is read via awk and concatenated directly into PS1 through __prompt-command without stripping control characters, causing injected OSC or CSI sequences to be written to and interpreted by the terminal emulator on every prompt render.
Weakness: CWE-150
Which versions are affected by CVE-2026-73036?
How do I fix CVE-2026-73036?
No fix has been published for CVE-2026-73036 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-73036 being exploited?
There is no known exploitation of CVE-2026-73036 in the wild and no public exploit code.
Sources
Also known as GHSA-jh23-4vmr-7f8q.