CVE-2026-73036
Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to inject arbitrary terminal control sequences by embedding escape sequences in the requires-python field of a pyproject.toml file. When a user navigates into a directory containing a maliciously crafted pyproject.toml, the unfiltered field value is read via awk and concatenated directly into PS1 through __prompt-command without stripping control characters, causing injected OSC or CSI sequences to be written to and interpreted by the terminal emulator on every prompt render.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 4.6
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
- EPSS probability
- 0.13%
- CWE
- CWE-150
- Published
- 2026-08-11
- Last modified
- 2026-08-12
Affected products
- Bash-it Bash-it
Weakness type
Related vulnerabilities
- CVE-2026-82710 — Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata
- CVE-2026-82584 — Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata
- CVE-2026-19591 — OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS...
- CVE-2026-72847 — broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree View
- CVE-2026-75483 — powerlevel10k Control Character Injection via package.json Version
- CVE-2026-73506 — Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data
- CVE-2026-73414 — Shescape: Shell injection via unescaped parentheses on Windows with CMD
- CVE-2026-72913 — Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences