Medium 4.4Published Aug 11, 2026

CVE-2026-73036Bash-it barbuk Theme 3.2.0 Terminal Escape Sequence Injection via pyproject.toml

Updated under an hour ago (2026-10-19 06:10 UTC)

Does this affect you?

It affects Bash-it. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Bash-it

Exploited in the last 30 days

Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to inject arbitrary terminal control sequences by embedding escape sequences in the requires-python field of a pyproject.toml file. When a user navigates into a directory containing a maliciously crafted pyproject.toml, the unfiltered field value is read via awk and concatenated directly into PS1 through __prompt-command without stripping control characters, causing injected OSC or CSI sequences to be written to and interpreted by the terminal emulator on every prompt render.

CVSS: 4.4 MEDIUM (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness (CWE): CWE-150
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Aug 12, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Bash-it Bash-it bash_it:bash_it (from the name)	through 3.2.0	CNA record

References

https://github.com/Bash-it/bash-itproduct
https://github.com/Bash-it/bash-it/commit/fab8f57818f28bfc6f2a81f86a58981c4ea72e5apatch
https://github.com/Bash-it/bash-it/issues/2396issue-tracking
https://github.com/Bash-it/bash-it/pull/2397technical-description
https://www.vulncheck.com/advisories/bash-it-barbuk-theme-terminal-escape-sequence-injection-via-pyproject-tomlthird-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.