https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 18:28:46 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352088 EUVD-2026-352088 https://cve.radiocsirt.org/vuln/euvd-2026-352088 https://cve.radiocsirt.org/vuln/fkie_cve-2026-73505 <p>Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1.</p> <p>Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-73505 https://cve.radiocsirt.org/vuln/ghsa-6xj8-qv9j-xcjq <p><strong>Affected:</strong> Go: github.com/jandedobbeleer/oh-my-posh</p> <p>### Summary Oh My Posh re-renders the resolved path string, which contains the raw folder names taken from the filesystem, through the Go `text/template` engine. That engine&#39;s function map exposes a `cmd` function that runs arbitrary OS commands. A directory whose name contains a Go template expression is therefore evaluated when the prompt renders, giving arbitrary command execution as the current user as soon as the shell is inside (or below) that directory. The built-in default configuration is affected.</p> <p>### Details `src/segments/path.go`, `setStyle()`:</p> <p>```go // make sure we resolve all templates if txt, err := template.Render(pt.Path, pt); err == nil { pt.Path = txt } ```</p> <p>`pt.Path` is built from the raw folder-name components of the current working directory (`colorizePath` inserts each folder name verbatim via `fmt.Sprintf(folderFormat, element)`). The whole string is then passed to `template.Render`, which parses and executes it with the full function map from `src/template/func_map.go`, including:</p> <p>```go func cmd(command string, args ...string) (string, error) { output, err := env.RunCommand(command, args...) return strings.TrimSpace(output), err } ```</p> <p>Any template syntax present in an untrusted folder name is evaluated. The render runs after the path-style switch unconditionally, so every path style is affected, and the default config (`src/config/default.go`) contains a path segment.</p> <p>### PoC Config (a single default path segment):</p> <p>```json { &#34;versio…</p> <p><strong>Affected:</strong> Go: github.com/jandedobbeleer/oh-my-posh</p> <p>### Summary Oh My Posh re-renders the resolved path string, which contains the raw folder names taken from the filesystem, through the Go `text/template` engine. That engine&#39;s function map exposes a `cmd` function that runs arbitrary OS commands. A directory whose name contains a Go template expression is therefore evaluated when the prompt renders, giving arbitrary command execution as the current user as soon as the shell is inside (or below) that directory. The built-in default configuration is affected.</p> <p>### Details `src/segments/path.go`, `setStyle()`:</p> <p>```go // make sure we resolve all templates if txt, err := template.Render(pt.Path, pt); err == nil { pt.Path = txt } ```</p> <p>`pt.Path` is built from the raw folder-name components of the current working directory (`colorizePath` inserts each folder name verbatim via `fmt.Sprintf(folderFormat, element)`). The whole string is then passed to `template.Render`, which parses and executes it with the full function map from `src/template/func_map.go`, including:</p> <p>```go func cmd(command string, args ...string) (string, error) { output, err := env.RunCommand(command, args...) return strings.TrimSpace(output), err } ```</p> <p>Any template syntax present in an untrusted folder name is evaluated. The render runs after the path-style switch unconditionally, so every path style is affected, and the default config (`src/config/default.go`) contains a path segment.</p> <p>### PoC Config (a single default path segment):</p> <p>```json { &#34;versio…</p> https://cve.radiocsirt.org/vuln/ghsa-6xj8-qv9j-xcjq