https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 25 Jul 2026 19:22:33 +0000 https://vulnerability.circl.lu/sighting/c95d4b28-e244-4ae3-934f-c7ed9973eb02/export {"uuid": "c95d4b28-e244-4ae3-934f-c7ed9973eb02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-FWJX-9P69-H25H", "type": "seen", "source": "https://gist.github.com/alon710/6f3f1af38179861cbb241baf278fc776", "content": "# GHSA-FWJX-9P69-H25H: GHSA-FWJX-9P69-H25H: Terminal Escape Sequence Injection in Oh My Posh\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-07-24\n> **Full Report:** https://cvereports.com/reports/GHSA-FWJX-9P69-H25H\n\n## Summary\nOh My Posh prior to version 29.35.1 is vulnerable to terminal escape sequence injection. Dynamic strings from directory names or Git repository metadata are written to the prompt output without neutralization, enabling unauthenticated remote code execution, clipboard hijacking, or terminal DoS when users navigate to malicious folders.\n\n## TL;DR\nOh My Posh rendered raw control characters from untrusted sources like directory names and Git commit logs, allowing attackers to hijack system clipboards or execute arbitrary commands upon terminal directory navigation.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-150\n- **Attack Vector**: Local\n- **CVSS Score**: 6.3\n- **EPSS Score**: N/A (No associated CVE)\n- **Impact**: Scope Change, Clipboard Hijacking, Potential Code Execution\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Oh My Posh on Windows, macOS, and Linux\n- **oh-my-posh**: < 29.35.1 (Fixed in: `29.35.1`)\n\n## Mitigation\n\n- Upgrade to Oh My Posh version 29.35.1 or later\n- Disable terminal emulator integrations for OSC 52 clipboard writes\n- Audit active Oh My Posh templates to remove unneeded git and path segments\n\n**Remediation Steps:**\n1. Check the current version by executing 'oh-my-posh --version'.\n2. Upgrade the engine using the platform-specific package manager (e.g., brew, winget, or go install).\n3. Ensure terminal configuration files limit clipboard write access from terminal utility streams.\n\n## References\n\n- [GHSA-fwjx-9p69-h25h Advisory](https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-fwjx-9p69-h25h)\n- [Security Patch Commit](https://github.com/JanDeDobbeleer/oh-my-posh/commit/edcf3c88f3fb582e84358b385c49d33d04c04224)\n- [Oh My Posh Repository](https://github.com/JanDeDobbeleer/oh-my-posh)\n- [Release v29.35.1](https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1)\n- [Release v29.36.0](https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.36.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-FWJX-9P69-H25H) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-25T08:31:11.350326Z"} {"uuid": "c95d4b28-e244-4ae3-934f-c7ed9973eb02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-FWJX-9P69-H25H", "type": "seen", "source": "https://gist.github.com/alon710/6f3f1af38179861cbb241baf278fc776", "content": "# GHSA-FWJX-9P69-H25H: GHSA-FWJX-9P69-H25H: Terminal Escape Sequence Injection in Oh My Posh\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-07-24\n> **Full Report:** https://cvereports.com/reports/GHSA-FWJX-9P69-H25H\n\n## Summary\nOh My Posh prior to version 29.35.1 is vulnerable to terminal escape sequence injection. Dynamic strings from directory names or Git repository metadata are written to the prompt output without neutralization, enabling unauthenticated remote code execution, clipboard hijacking, or terminal DoS when users navigate to malicious folders.\n\n## TL;DR\nOh My Posh rendered raw control characters from untrusted sources like directory names and Git commit logs, allowing attackers to hijack system clipboards or execute arbitrary commands upon terminal directory navigation.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-150\n- **Attack Vector**: Local\n- **CVSS Score**: 6.3\n- **EPSS Score**: N/A (No associated CVE)\n- **Impact**: Scope Change, Clipboard Hijacking, Potential Code Execution\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Oh My Posh on Windows, macOS, and Linux\n- **oh-my-posh**: < 29.35.1 (Fixed in: `29.35.1`)\n\n## Mitigation\n\n- Upgrade to Oh My Posh version 29.35.1 or later\n- Disable terminal emulator integrations for OSC 52 clipboard writes\n- Audit active Oh My Posh templates to remove unneeded git and path segments\n\n**Remediation Steps:**\n1. Check the current version by executing 'oh-my-posh --version'.\n2. Upgrade the engine using the platform-specific package manager (e.g., brew, winget, or go install).\n3. Ensure terminal configuration files limit clipboard write access from terminal utility streams.\n\n## References\n\n- [GHSA-fwjx-9p69-h25h Advisory](https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-fwjx-9p69-h25h)\n- [Security Patch Commit](https://github.com/JanDeDobbeleer/oh-my-posh/commit/edcf3c88f3fb582e84358b385c49d33d04c04224)\n- [Oh My Posh Repository](https://github.com/JanDeDobbeleer/oh-my-posh)\n- [Release v29.35.1](https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1)\n- [Release v29.36.0](https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.36.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-FWJX-9P69-H25H) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-25T08:31:11.350326Z"} https://vulnerability.circl.lu/sighting/c95d4b28-e244-4ae3-934f-c7ed9973eb02/export Sat, 25 Jul 2026 08:31:11 +0000