Go/github.com/jandedobbeleer/oh-my-posh CVE-2026-73505: high 7.8, EPSS 0.21%
Oh My Posh: Arbitrary command execution via template injection in the path segment
Action: Upgrade github.com/jandedobbeleer/oh-my-posh to 29.35.1 or later.
go get github.com/jandedobbeleer/oh-my-posh@v29.35.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 29.35.1 | - |
Fixed versions
| 29.35.1 |
Sources
- osv: GHSA-6xj8-qv9j-xcjq
- https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq
- https://github.com/JanDeDobbeleer/oh-my-posh/commit/88ddbe0b0a4dd13cc345996108c9869493f2c690
- https://github.com/JanDeDobbeleer/oh-my-posh
- https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1
- https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.36.0
CVE-2026-73505 · published · modified · JSON