CVE-2026-73505

Name of the Vulnerable Software and Affected Versions Oh My Posh versions prior to 29.35.1

Description The setStyle() function in src/segments/path.go passes pt.Path, which contains raw folder names, to template.Render. Because the function map exposes cmd, a directory name controlled by an attacker containing a Go template expression can lead to arbitrary operating system command execution as the current user when the prompt renders within that directory or its descendants. This is a template injection issue where untrusted input is processed by the template engine.

Recommendations Update to version 29.35.1.