DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-FWJX-9P69-H25H: GHSA-FWJX-9P69-H25H: Terminal Escape Sequence Injection in Oh My Posh

#security #cve #cybersecurity #ghsa

GHSA-FWJX-9P69-H25H: Terminal Escape Sequence Injection in Oh My Posh

Vulnerability ID: GHSA-FWJX-9P69-H25H
CVSS Score: 6.3
Published: 2026-07-24

Oh My Posh prior to version 29.35.1 is vulnerable to terminal escape sequence injection. Dynamic strings from directory names or Git repository metadata are written to the prompt output without neutralization, enabling unauthenticated remote code execution, clipboard hijacking, or terminal DoS when users navigate to malicious folders.

TL;DR

Oh My Posh rendered raw control characters from untrusted sources like directory names and Git commit logs, allowing attackers to hijack system clipboards or execute arbitrary commands upon terminal directory navigation.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-150
  • Attack Vector: Local
  • CVSS Score: 6.3
  • EPSS Score: N/A (No associated CVE)
  • Impact: Scope Change, Clipboard Hijacking, Potential Code Execution
  • Exploit Status: Proof-of-Concept (PoC)
  • KEV Status: Not Listed

Affected Systems

  • Oh My Posh on Windows, macOS, and Linux
  • oh-my-posh: < 29.35.1 (Fixed in: 29.35.1)

Code Analysis

Commit: edcf3c8

fix: terminal: drop C0/C1 control runes

func write(s rune) { ... if isControlRune(s) { return } ... }
Enter fullscreen mode Exit fullscreen mode

Exploit Details

Mitigation Strategies

  • Upgrade to Oh My Posh version 29.35.1 or later
  • Disable terminal emulator integrations for OSC 52 clipboard writes
  • Audit active Oh My Posh templates to remove unneeded git and path segments

Remediation Steps:

  1. Check the current version by executing 'oh-my-posh --version'.
  2. Upgrade the engine using the platform-specific package manager (e.g., brew, winget, or go install).
  3. Ensure terminal configuration files limit clipboard write access from terminal utility streams.

References

Read the full report for GHSA-FWJX-9P69-H25H on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)