Summary
Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data
Oh My Posh renders dynamic, potentially attacker-controlled strings (the current directory name, Git commit metadata, environment variable values, command output) into the prompt without neutralizing raw terminal control characters. An attacker who controls one of these values can inject ANSI/OSC escape sequences that the victim's terminal executes on every prompt render. (This is separate from the path-segment command-execution report; it has a different root cause and fix.)
Details
src/terminal/writer.go, write(s rune): the literal characters of rendered segment content are emitted to the output buffer, and the only neutralization is a lookup in formats.EscapeSequences, which per shell contains only the shell's prompt-length markers (\ for bash, % for zsh, nothing for fish/pwsh/cmd/nu). Raw C0/C1 control bytes (ESC 0x1b, BEL 0x07, CSI, OSC) are written verbatim.
Oh My Posh's own styling is emitted through separate paths (writeEscapedAnsiString, writeColorise, builder.WriteString(formats.Hyperlink...)), so any control rune reaching write(s rune) originates from rendered data. trimAnsi is already applied to the console title (FormatTitle) but not to the prompt body.
Attacker-controlled sources (both verified)
- Current directory name (default config, Linux/macOS). Directory names may contain any byte except
/and NUL, including0x1b. The path segment renders the working directory in every theme. - Git commit subject / author / upstream URL (cross-platform, including Windows).
Git.Commit()runsgit log -1 --pretty=format:...su:%s...and exposes.Commit.Subject,.Commit.Author.Name/.Emailand.RawUpstreamURL; Git imposes no restriction on these, so they can carry raw escape sequences.
PoC
Git commit-subject vector (config: a single git segment with template {{ .Commit.Subject }}):
printf 'feat: \033]0;HACKED\007\033]52;c;ZWNobyBQV05FRA==\007 update' > msg.txt
git commit --allow-empty -F msg.txt
oh-my-posh print primary --config poc.omp.json --shell fish | xxd
Output (excerpt) shows the attacker's OSC 0 (set title) and OSC 52 (clipboard write) passed through unmodified, wrapped only in Oh My Posh's colors:
...255m feat: 1b5d 303b 4841 434b 4544 07 1b5d 3532 3b63 3b5a 574e ... 07 ...
ESC ] 0 ; H A C K E D BEL ESC ] 5 2 ; c ; <base64> BEL
The directory-name vector reproduces identically via the path segment.
Impact
The terminal interprets the injected sequences on every render, enabling, per emulator: clipboard hijacking (OSC 52 write, so a command placed in the clipboard runs when the victim pastes), prompt/screen spoofing, window-title manipulation, and terminal denial of service. Delivery is remote (repo/archive/share); execution is local when the prompt renders after cd.
Suggested fix: neutralize C0/C1 control characters in untrusted segment data before it reaches the terminal, at minimum the path segment (folder names) and the git segment (Commit.Subject, Commit.Author.*, RawUpstreamURL). trimAnsi already exists and is applied to the title; extending equivalent handling to segment data closes the gap. Filtering control runes in write(s rune) would also work as defense in depth (Oh My Posh's own styling never flows through that function), optionally behind an opt-out for users who deliberately embed escapes in their own templates.
GHSA-FWJX-9P69-H25H has a CVSS score of 6.1 (Medium). The vector is requires local access, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (29.35.1); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is GHSA-FWJX-9P69-H25H? GHSA-FWJX-9P69-H25H is a medium-severity security vulnerability in github.com/jandedobbeleer/oh-my-posh (go), affecting versions <= 29.35.0. It is fixed in 29.35.1.
- How severe is GHSA-FWJX-9P69-H25H? GHSA-FWJX-9P69-H25H has a CVSS score of 6.1 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of github.com/jandedobbeleer/oh-my-posh are affected by GHSA-FWJX-9P69-H25H? github.com/jandedobbeleer/oh-my-posh (go) versions <= 29.35.0 is affected.
- Is there a fix for GHSA-FWJX-9P69-H25H? Yes. GHSA-FWJX-9P69-H25H is fixed in 29.35.1. Upgrade to this version or later.
- Is GHSA-FWJX-9P69-H25H exploitable, and should I be worried? Whether GHSA-FWJX-9P69-H25H is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-FWJX-9P69-H25H is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-FWJX-9P69-H25H? Upgrade
github.com/jandedobbeleer/oh-my-poshto 29.35.1 or later.