CVE-2026-73036

Name of the Vulnerable Software and Affected Versions Bash-it version 3.2.0

Description A terminal escape sequence injection exists in the barbuk theme's Python virtualenv prompt segment. A local attacker can inject arbitrary terminal control sequences by embedding them in the requires-python field of a pyproject.toml file. When a user enters a directory containing a crafted pyproject.toml, the value is read via awk and added to PS1 through prompt-command without removing control characters. This results in Operating System Command (OSC) or Control Sequence Introducer (CSI) sequences being interpreted by the terminal emulator during every prompt render.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.