The vulnerability permits a local attacker to insert arbitrary terminal control sequences into the requires‑python field of a pyproject.toml. When a user changes to a directory containing such a file, Bash‑it reads the field with awk, directly appends its content to the PS1 prompt via __prompt-command, and the terminal emulator interprets any OSC or CSI sequences embedded in that text. This can cause unintended terminal behaviour, message manipulation or temporary loss of prompt functionality.

Bash‑it 3.2.0, particularly the barbuk theme’s virtualenv prompt component, is affected when a user navigates into a directory with a maliciously crafted pyproject.toml. No other versions or vendors are listed.

The CVSS base score of 4.6 denotes moderate severity, while the EPSS score of less than 1 % indicates a low likelihood of exploitation. The vulnerability is not present in CISA’s KEV catalog. Exploitation requires local access to a directory and a user who subsequently changes into that directory; there is no network vector. The impact is confined to the local session and can result in terminal manipulation or denial of normal prompt operation.