CyberRota Analysis
AI-GeneratedOh My Posh versions prior to 29.35.1 are vulnerable to terminal escape sequence injection due to improper handling of attacker-controlled directory names and Git metadata, which can lead to clipboard overwrites, prompt spoofing, and terminal disruptions. Users of this customizable shell prompt renderer should prioritize updating to version 29.35.1 to mitigate these risks. This vulnerability is particularly relevant for developers and system administrators who rely on terminal environments for their workflows.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune) in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and RawUpstreamURL, without removing C0/C1 terminal control characters such as ESC, BEL, CSI, and OSC, allowing terminal escape sequence injection during prompt rendering that could overwrite the clipboard, spoof the prompt or screen, manipulate the window title, or disrupt the terminal. This issue is fixed in version 29.35.1.