CVE-2026-73506: Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune

Oh My Posh, a tool that customizes command-line prompts across different systems, had a security flaw before version 29.35.1 where it didn't filter out terminal control characters (special codes like ESC that give commands to terminals) from file paths and Git information (version control metadata). This allowed attackers to inject terminal escape sequences (hidden commands that execute when the prompt is displayed), potentially letting them steal clipboard data, fake what appears on screen, change the window title, or crash the terminal.