Executive brief
Oh My Posh is a popular custom prompt engine for terminal shells. A vulnerability exists where the tool fails to sanitize special terminal control characters found in directory names or Git metadata. An attacker can use this to trick a user's terminal into performing unauthorized actions, such as hijacking the clipboard, spoofing the screen, or crashing the terminal session when the user navigates into a malicious repository or directory.
Technical details
Oh My Posh renders dynamic strings (e.g., current directory, Git commit subjects, author names) into the shell prompt without neutralizing raw terminal control characters (C0/C1 control bytes like ESC and BEL). The vulnerability resides in `src/terminal/writer.go` within the `write(s rune)` function, which emits literal characters to the output buffer. An attacker can craft a directory name or a Git repository with malicious escape sequences that are executed by the victim's terminal emulator upon prompt rendering. This can lead to clipboard hijacking (via OSC 52), window title manipulation, or terminal denial of service. The issue is fixed in version 29.35.1 by applying ANSI neutralization to prompt segment data.
Affected products
- JanDeDobbeleer oh-my-posh <= 29.35.0
Timeline
- 2026-07-23: disclosed
- 2026-07-24: advisory
- 2026-07-24: patched: Fixed in version 29.35.1