Upstream information
Description
Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1.SUSE information
Overall state of this security issue: Resolved
This issue is currently rated as having important severity.
| CVSS detail | CNA (GitHub) |
|---|---|
| Base Score | 7.8 |
| Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| Attack Vector | Local |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | Required |
| Scope | Unchanged |
| Confidentiality Impact | High |
| Integrity Impact | High |
| Availability Impact | High |
| CVSSv3 Version | 3.1 |
SUSE Security Advisories:
- SUSE-SU-2026:23625-1, published 2026-09-04T12:30:23Z
List of released packages
| Product(s) | Fixed package version(s) | References |
|---|---|---|
| SUSE Linux Enterprise Server 16.1 |
| Patchnames: SUSE Linux Enterprise Server 16.1 GA govulncheck-vulndb-0.0.20260916T180043-160100.1.1 (aarch64,ppc64le,s390x,x86_64) |
| SUSE Linux Enterprise Server for SAP applications 16.1 |
| Patchnames: SUSE Linux Enterprise Server for SAP applications 16.1 GA govulncheck-vulndb-0.0.20260916T180043-160100.1.1 (aarch64,ppc64le,s390x,x86_64) |
SUSE Timeline for this CVE
CVE page created: Fri Sep 4 16:52:18 2026CVE page last modified: Wed Nov 4 17:45:26 2026