The vulnerability is a template injection in the path segment handling of Oh My Posh. The setStyle function forwards the raw folder name to the template renderer, which provides a cmd function that can invoke operating system commands. An attacker who can create or control a directory name containing a Go template expression can cause the prompt to evaluate that expression each time it renders inside that directory or its descendants, thereby executing arbitrary OS commands as the current user. This results in full remote code execution, compromising confidentiality, integrity, and availability of the affected system.

The affected product is Oh My Posh, maintained by JanDeDobbeleer. Versions older than 29.35.1 are vulnerable. The issue is fixed in release v29.35.1 and later.

The CVSS score of 7.8 indicates high severity. EPSS is not available, but the product is niche so exploit likelihood may be low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply a malicious directory name and for a user to render the prompt within that directory or its subdirectories; thus initial access may be achieved via social engineering, compromised credentials, or by placing the malicious path on a shared or network file system that the user mounts. Once the prompt renders, the attacker-controlled template can spawn any command with the user’s privileges.