Go/github.com/jandedobbeleer/oh-my-posh CVE-2026-73506: medium 6.1, EPSS 0.18%
Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data
Action: Upgrade github.com/jandedobbeleer/oh-my-posh to 29.35.1 or later.
go get github.com/jandedobbeleer/oh-my-posh@v29.35.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 29.35.1 | - |
Fixed versions
| 29.35.1 |
Sources
- osv: GHSA-fwjx-9p69-h25h
- https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-fwjx-9p69-h25h
- https://github.com/JanDeDobbeleer/oh-my-posh/commit/edcf3c88f3fb582e84358b385c49d33d04c04224
- https://github.com/JanDeDobbeleer/oh-my-posh
- https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1
- https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.36.0
CVE-2026-73506 · published · modified · JSON