—
GO-2026-6108
Oh My Posh: Arbitrary command execution via template injection in the path segment in github.com/jandedobbeleer/oh-my-posh
Quick fix
GO-2026-6108 — github.com/jandedobbeleer/oh-my-posh: upgrade to the fixed version with the command below.
go get github.com/jandedobbeleer/oh-my-posh@v29.35.1+incompatibleDetails
Oh My Posh: Arbitrary command execution via template injection in the path segment in github.com/jandedobbeleer/oh-my-posh
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/jandedobbeleer/oh-my-posh
Introduced in:
0Fixed in: 29.35.1+incompatibleFix
go get github.com/jandedobbeleer/oh-my-posh@v29.35.1+incompatibleReferences
- https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq[ADVISORY]
- https://github.com/JanDeDobbeleer/oh-my-posh/commit/88ddbe0b0a4dd13cc345996108c9869493f2c690[WEB]
- https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.35.1[WEB]
- https://github.com/JanDeDobbeleer/oh-my-posh/releases/tag/v29.36.0[WEB]