CVE-2026-73505 Oh My Posh: Arbitrary command execution via template injection in the path segment
An attacker can execute arbitrary OS commands by placing a malicious directory name that triggers template injection in Oh My Posh.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-73505?
CVE-2026-73505 is a high-severity code injection vulnerability in JanDeDobbeleer oh-my-posh, published on 13 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1.
Which versions are affected by CVE-2026-73505?
3 open source packages ship an affected version, including github.com/jandedobbeleer/oh-my-posh.
| Package | Affected | Fixed in |
|---|---|---|
github.com/jandedobbeleer/oh-my-posh Go | All versions | 29.35.1 |
github.com/jandedobbeleer/oh-my-posh Go | All versions | 29.35.1 |
github.com/jandedobbeleer/oh-my-posh Go | All versions | 29.35.1+incompatible |
How do I fix CVE-2026-73505?
Upgrade github.com/jandedobbeleer/oh-my-posh to a fixed version for your release line: 29.35.1 or 29.35.1+incompatible.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-73505 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73505 exists.
Sources
Also known as GHSA-6xj8-qv9j-xcjq, GO-2026-6108.