CVE-2026-73506 JanDeDobbeleer CVE debrief

Who should care

Defenders responsible for terminal environments using Oh My Posh should assess exposure and prioritize verification and remediation efforts. This includes operators, platform administrators, vulnerability management teams, and security teams who manage or use Oh My Posh in their environments.

Why it matters

CVE-2026-73506 is a medium-severity vulnerability in Oh My Posh that allows terminal escape sequence injection, potentially disrupting terminal environments. Defenders should prioritize verification and remediation efforts.

• Terminal escape sequence injection could allow an attacker to overwrite the clipboard, spoof the prompt or screen, manipulate the window title, or disrupt the terminal.
• Defenders should verify exposure in terminal environments using Oh My Posh versions prior to 29.35.1.
• Remediation priority is high for environments using affected versions.

Technical summary

Oh My Posh versions prior to 29.35.1 are vulnerable to terminal escape sequence injection due to the emission of attacker-controlled current directory names and Git metadata without removing C0/C1 terminal control characters. This issue allows terminal escape sequence injection during prompt rendering that could overwrite the clipboard, spoof the prompt or screen, manipulate the window title, or disrupt the terminal. The vulnerability has a medium severity with a CVSS score of 6.1 and is fixed in version 29.35.1. Defenders should prioritize verifying exposure in terminal environments using Oh My Posh versions prior to 29.35.1.

Defensive priority

Defenders should prioritize verifying exposure in terminal environments using Oh My Posh versions prior to 29.35.1 and assessing the effectiveness of their current security controls.

Recommended defensive actions

• Verify exposure in terminal environments using Oh My Posh versions prior to 29.35.1
• Assess the effectiveness of current security controls
• Update to version 29.35.1 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source metadata indicate that Oh My Posh versions prior to 29.35.1 are vulnerable to terminal escape sequence injection. The issue is fixed in version 29.35.1. Evidence is limited to CVE and NVD source records. Defenders should verify exposure in terminal environments using Oh My Posh versions prior to 29.35.1 and assess the effectiveness of their current security controls.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.