Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/jandedobbeleer/oh-my-posh <= 29.35.0
Fixed in
29.35.1· Vendor fix available
Issue
Oh My Posh re-renders the resolved path string, which contains the raw folder names taken from the filesystem, through the Go text/template engine. That engine's function map exposes a cmd function that runs arbitrary OS commands. A directory whose name contains a Go template expression is therefore evaluated when the prompt renders, giving arbitrary command execution as the current user as soon as the shell is inside (or below) that directory. The built-in default configuration is affected. Details src/segments/path.go, setStyle(): pt.Path is built from the raw folder-name components of the current working directory (colorizePath inserts each folder name verbatim via fmt.Sprintf(folderFormat, element)). The whole string is then passed to template.Render, which parses and executes it with the full function map from src/template/funcmap.go, including: Any template syntax present in an untrusted folder name is evaluated. The render runs after the path-style switch…
Recommended action: Upgrade to 29.35.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/jandedobbeleer/oh-my-posh <= 29.35.0
Fixed in
29.35.1· Vendor fix available
Issue
Oh My Posh renders dynamic, potentially attacker-controlled strings (the current directory name, Git commit metadata, environment variable values, command output) into the prompt without neutralizing raw terminal control characters. An attacker who controls one of these values can inject ANSI/OSC escape sequences that the victim's terminal executes on every prompt render. (This is separate from the path-segment command-execution report; it has a different root cause and fix.) Details src/terminal/writer.go, write(s rune): the literal characters of rendered segment content are emitted to the output buffer, and the only neutralization is a lookup in formats.EscapeSequences, which per shell contains only the shell's prompt-length markers (\ for bash, % for zsh, nothing for fish/pwsh/cmd/nu). Raw C0/C1 control bytes (ESC 0x1b, BEL 0x07, CSI, OSC) are written verbatim. Oh My Posh's own styling is emitted through separate paths (writeEscapedAnsiString, writeColorise,…
Recommended action: Upgrade to 29.35.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.