Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to inject arbitrary terminal control sequences by embedding escape sequences in the requires-python field of a pyproject.toml file. When a user navigates into a directory containing a maliciously crafted pyproject.toml, the unfiltered field value is read via awk and concatenated directly into PS1 through __prompt-command without stripping control characters, causing injected OSC or CSI sequences to be written to and interpreted by the terminal emulator on every prompt render.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Active
User action required
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
bash-it:bash-it
References 5
https://github.com/Bash-it/bash-it
Product Repository
https://github.com/Bash-it/bash-it/commit/fab8f57818f28bfc6f2a81f86a58981c4ea72…
Patch Commit
https://github.com/Bash-it/bash-it/issues/2396
GitHub Issue
https://github.com/Bash-it/bash-it/pull/2397
Pull Request
https://www.vulncheck.com/advisories/bash-it-barbuk-theme-terminal-escape-seque…
NVD