JanDeDobbeleer CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM JanDeDobbeleer CVE published 2026-08-13

CVE-2026-73506

CVE-2026-73506 debrief based on the supplied source corpus. The CVE record was published on 2026-08-13T15:20:17.133Z and has not been modified since then. Oh My Posh versions prior to 29.35.1 are vulnerable to terminal escape sequence injection due to the emission of attacker-controlled current directory names and Git metadata without removing C0/C1 terminal control characters. This issue allows terminal [truncated]

HIGH JanDeDobbeleer CVE published 2026-08-13

CVE-2026-73505

CVE-2026-73505 is a high-severity vulnerability in Oh My Posh, a customizable and low-latency cross-platform/shell prompt renderer. An attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user when the prompt is rendered inside that directory or a descendant. The issue is fixed in version 29.35.1.