Dashboard / CVE-2026-73036

CVE-2026-73036

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 34/100
Published: 2026-08-11 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Low Complexity No Auth

CVSS Vector Breakdown

AV: Local
AC: Low
PR: None
UI: Active
AT: None
VC: Low
VI: Low
VA: None

Description

Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to inject arbitrary terminal control sequences by embedding escape sequences in the requires-python field of a pyproject.toml file. When a user navigates into a directory containing a maliciously crafted pyproject.toml, the unfiltered field value is read via awk and concatenated directly into PS1 through __prompt-command without stripping control characters, causing injected OSC or CSI sequences to be written to and interpreted by the terminal emulator on every prompt render.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
Bash-it Bash-it 0

References & Advisories (5)

https://github.com/Bash-it/bash-it/pull/2397
technical-description patch

Bug Bounty Relevance

34 / 100
✓ No authentication
✓ Low complexity

CVSS Score

4.6 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

EPSS — Exploitation Probability

0.18%
Raw Score 0.001770
Percentile 7.4%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00177
2026-11-12
0.00177
2026-11-10
0.00177
2026-11-09
0.00177
2026-11-08
0.00177

Intelligence Sources

mitre ref →

External Links