CVE-2026-73036: Bash-it Terminal Escape Sequence Injection

CVE-2026-73036 Overview

CVE-2026-73036 is a terminal escape sequence injection vulnerability in Bash-it 3.2.0, specifically within the barbuk theme's Python virtualenv prompt segment. Local attackers can inject arbitrary terminal control sequences by embedding escape characters in the requires-python field of a pyproject.toml file. When a user navigates into a directory containing the malicious file, the unfiltered value is read via awk and concatenated directly into PS1 through __prompt-command. The injected Operating System Command (OSC) or Control Sequence Introducer (CSI) sequences are then interpreted by the terminal emulator on every prompt render. The flaw is classified under [CWE-150] (Improper Neutralization of Escape, Meta, or Control Sequences).

Critical Impact
A crafted pyproject.toml file can trigger terminal control sequence execution simply by a user changing directory, enabling display spoofing, clipboard manipulation, or command injection depending on the terminal emulator.

Affected Products

Bash-it version 3.2.0
The barbuk theme (themes/barbuk/barbuk.theme.bash)
Any shell environment loading the vulnerable theme with the virtualenv prompt segment enabled

Discovery Timeline

2026-08-11 - CVE-2026-73036 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73036

Vulnerability Analysis

Bash-it is a community-maintained framework that adds themes, plugins, and completions to Bash. The barbuk theme includes a prompt segment that displays Python virtual environment information based on the requires-python field parsed from pyproject.toml files in the current working directory. The theme uses awk to extract the raw field value and injects that string directly into the PS1 prompt variable through the __prompt-command helper. No sanitization is performed on the extracted content, so any ANSI escape sequence embedded in requires-python is preserved through the parsing pipeline. Every time the shell renders a prompt, the terminal emulator interprets those control bytes as legitimate commands rather than displayable text.

Root Cause

The root cause is missing neutralization of control characters when interpolating untrusted file content into the shell prompt. The barbuk theme trusts pyproject.toml values as safe strings and passes them through echo -e, which additionally interprets backslash escapes. This combination amplifies the injection surface because both raw escape bytes and encoded sequences reach the terminal.

Attack Vector

An attacker plants a malicious pyproject.toml in a directory a target may enter, for example a cloned repository, an extracted archive, or a shared filesystem location. When the victim runs cd into the directory, Bash-it invokes the prompt-generation logic and emits attacker-controlled OSC or CSI sequences to the terminal. Depending on the terminal emulator, consequences include altering the window title, writing to the clipboard, redefining color palettes, or in permissive emulators, injecting keystrokes that execute follow-on commands.

text

 function git_prompt_info() {
 	git_prompt_vars
-	echo -e "on $SCM_GIT_CHAR_ICON_BRANCH $SCM_PREFIX$SCM_BRANCH$SCM_STATE$SCM_GIT_AHEAD$SCM_GIT_BEHIND$SCM_GIT_STASH$SCM_SUFFIX "
+	echo "on $SCM_GIT_CHAR_ICON_BRANCH $SCM_PREFIX$SCM_BRANCH$SCM_STATE$SCM_GIT_AHEAD$SCM_GIT_BEHIND$SCM_GIT_STASH$SCM_SUFFIX "
 }
 
 function __exit_prompt() {

Source: GitHub Commit fab8f57 — the patch replaces echo -e with plain echo to stop interpretation of backslash-escaped sequences and applies control character stripping to untrusted input.

Detection Methods for CVE-2026-73036

Indicators of Compromise

Presence of pyproject.toml files containing non-printable bytes such as \\x1b, \\x9b, or literal ANSI escape sequences in the requires-python field
Unexpected terminal behavior after cd operations, including title changes, palette shifts, or clipboard modifications
Repository clones or archives originating from untrusted sources that include pyproject.toml with unusually long or binary content

Detection Strategies

Scan file system paths and code repositories for pyproject.toml files containing ESC (0x1B) or CSI (0x9B) byte sequences using tools such as grep -P "\\x1b".
Audit Bash-it installations for the vulnerable barbuk theme by inspecting themes/barbuk/barbuk.theme.bash for the pre-patch awk extraction of requires-python.
Monitor shell process telemetry for anomalous awk invocations against pyproject.toml originating from prompt rendering.

Monitoring Recommendations

Log directory-change events on multi-user or shared systems and correlate with the creation of pyproject.toml files in user-writable paths.
Enable terminal emulator options that disable clipboard writes, title stack modifications, and window manipulation OSC sequences.
Track newly cloned repositories in developer environments and flag those containing pyproject.toml files with control characters.

How to Mitigate CVE-2026-73036

Immediate Actions Required

Update Bash-it to a version that includes commit fab8f57818f28bfc6f2a81f86a58981c4ea72e5a from the upstream repository.
Switch away from the barbuk theme to an unaffected theme until the patch is deployed.
Audit shared and cloned directories for pyproject.toml files containing embedded escape sequences and remove or sanitize them.

Patch Information

The upstream fix is delivered in Pull Request #2397 and merged as commit fab8f57. The patch replaces echo -e with echo in prompt helpers and strips control characters from untrusted pyproject.toml values. Additional context is available in the VulnCheck Security Advisory and in GitHub Issue #2396.

Workarounds

Disable the Python virtualenv prompt segment within the barbuk theme configuration.
Configure the terminal emulator to reject OSC 52 clipboard writes and other high-risk sequences.
Avoid entering directories from untrusted sources until the theme is patched or replaced.

bash

# Update Bash-it and switch to a safe theme
cd "$BASH_IT" && git pull origin master
bash-it reload
bash-it use theme bobby