CyberRota Analysis
AI-GeneratedThe vulnerability affects Oh My Posh versions prior to 29.35.1, where the setStyle() function improperly handles user-controlled directory names, allowing attackers to execute arbitrary OS commands through crafted Go template expressions. This poses a significant risk as it can lead to unauthorized command execution under the current user's privileges. Organizations using affected versions should prioritize updating to version 29.35.1 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1.