{"uuid": "3aaf8967-7a0e-4a1f-b024-ba3926af00e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-6xj8-qv9j-xcjq", "type": "seen", "source": "https://gist.github.com/alon710/e9c3b68dd2dd0898bdce9f4d836eceff", "content": "# GHSA-6XJ8-QV9J-XCJQ: GHSA-6XJ8-QV9J-XCJQ: Arbitrary Command Execution via Template Injection in Oh My Posh\n\n> **CVSS Score:** 7.8\n> **Published:** 2026-07-24\n> **Full Report:** https://cvereports.com/reports/GHSA-6XJ8-QV9J-XCJQ\n\n## Summary\nA critical-severity template injection vulnerability in Oh My Posh allows for unauthenticated arbitrary command execution. This issue occurs when a user navigates their shell into a directory whose name contains malicious Go template syntax, which is subsequently parsed and executed by the prompt engine.\n\n## TL;DR\nNavigating to a directory containing malicious Go template syntax in its name triggers immediate, arbitrary OS command execution under the current shell user context via Oh My Posh.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-1336 / CWE-94\n- **Attack Vector**: Local (AV:L)\n- **CVSS v3.1**: 7.8 (High)\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n- **Impact**: Arbitrary OS Command Execution as Current User\n\n## Affected Systems\n\n- Oh My Posh versions <= 29.35.0\n- **oh-my-posh**: <= 29.35.0 (Fixed in: `29.35.1`)\n\n## Mitigation\n\n- Upgrade to Oh My Posh version 29.35.1, 29.36.0, or newer to resolve the unescaped template parsing bug.\n- Enforce process logging and monitoring to detect anomalous child processes spawned by shell prompts.\n- Inspect untrusted local Git repositories or file system structures before executing shell navigation commands.\n\n**Remediation Steps:**\n1. For package-manager-based installations (e.g., Homebrew, Winget, Scoop), execute the specific upgrade command: `brew upgrade oh-my-posh` or `winget upgrade JanDeDobbeleer.OhMyPosh`.\n2. For Go-based builds, fetch the patched package using: `go get github.com/jandedobbeleer/oh-my-posh@v29.35.1`.\n3. Verify that the active version has been updated successfully by running `oh-my-posh --version`.\n\n## References\n\n- [GitHub Security Advisory GHSA-6xj8-qv9j-xcjq](https://github.com/advisories/GHSA-6XJ8-QV9J-XCJQ)\n- [Remediation Patch Commit](https://github.com/JanDeDobbeleer/oh-my-posh/commit/88ddbe0b0a4dd13cc345996108c9869493f2c690)\n- [Oh My Posh Release v29.35.1](https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1)\n- [Oh My Posh Release v29.36.0](https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.36.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-6XJ8-QV9J-XCJQ) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-25T07:31:13.935083Z"}