DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-6XJ8-QV9J-XCJQ: GHSA-6XJ8-QV9J-XCJQ: Arbitrary Command Execution via Template Injection in Oh My Posh

#security #cve #cybersecurity #ghsa

GHSA-6XJ8-QV9J-XCJQ: Arbitrary Command Execution via Template Injection in Oh My Posh

Vulnerability ID: GHSA-6XJ8-QV9J-XCJQ
CVSS Score: 7.8
Published: 2026-07-24

A critical-severity template injection vulnerability in Oh My Posh allows for unauthenticated arbitrary command execution. This issue occurs when a user navigates their shell into a directory whose name contains malicious Go template syntax, which is subsequently parsed and executed by the prompt engine.

TL;DR

Navigating to a directory containing malicious Go template syntax in its name triggers immediate, arbitrary OS command execution under the current shell user context via Oh My Posh.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-1336 / CWE-94
  • Attack Vector: Local (AV:L)
  • CVSS v3.1: 7.8 (High)
  • Exploit Status: PoC Available
  • KEV Status: Not Listed
  • Impact: Arbitrary OS Command Execution as Current User

Affected Systems

  • Oh My Posh versions <= 29.35.0
  • oh-my-posh: <= 29.35.0 (Fixed in: 29.35.1)

Code Analysis

Commit: 88ddbe0

Fix: restrict dangerous template functions when processing dynamic paths

Mitigation Strategies

  • Upgrade to Oh My Posh version 29.35.1, 29.36.0, or newer to resolve the unescaped template parsing bug.
  • Enforce process logging and monitoring to detect anomalous child processes spawned by shell prompts.
  • Inspect untrusted local Git repositories or file system structures before executing shell navigation commands.

Remediation Steps:

  1. For package-manager-based installations (e.g., Homebrew, Winget, Scoop), execute the specific upgrade command: brew upgrade oh-my-posh or winget upgrade JanDeDobbeleer.OhMyPosh.
  2. For Go-based builds, fetch the patched package using: go get github.com/jandedobbeleer/oh-my-posh@v29.35.1.
  3. Verify that the active version has been updated successfully by running oh-my-posh --version.

References

Read the full report for GHSA-6XJ8-QV9J-XCJQ on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)