Bash-it Terminal Escape Sequence Injection via pyproject.toml
First seen Aug 12, 2026 · Updated Aug 12, 2026 · CVSS 4.4
This CVE describes a terminal escape sequence injection bug in the Bash-it shell customization framework, unrelated to AI agents, LLMs, or agent protocols despite being surfaced by an 'agent keyword' search matching the term 'prompt injection.' It requires a local attacker to plant a malicious pyproject.toml file and for a victim to cd into that directory, after which unfiltered data is written into the shell prompt (PS1). This is a legitimate but minor terminal-emulator vulnerability, not a genuine AI agent security threat, so it is flagged as low severity for this analysis context.
Technical Analysis
The vulnerability lies in Bash-it's barbuk theme, which uses awk to extract the 'requires-python' field from a pyproject.toml file and concatenates it directly into the PS1 prompt string via the __prompt-command function without sanitizing control characters. A local attacker crafts a pyproject.toml with embedded OSC/CSI terminal escape sequences; when a victim's shell renders the prompt inside that directory, the terminal emulator interprets the injected sequences, potentially enabling actions like title-bar spoofing, cursor manipulation, or in vulnerable terminal emulators, more impactful effects (e.g., clipboard manipulation depending on emulator support). This is a classic terminal escape injection issue analogous to other 'malicious filename/output' terminal attacks, entirely within a local shell context with no AI model, agent, or inter-agent protocol involved. The 'prompt' in this bug refers to a shell PS1 prompt, not an LLM prompt, so the keyword match is a false positive for agent-security purposes.
Affected Systems
Bash-it
Detection Signatures
- pyproject.toml files containing raw ESC (\x1b) or control characters in the requires-python field
- Unusual OSC/CSI sequences appearing in terminal title, colors, or cursor position after cd into untrusted directories
- awk-based extraction of TOML fields without stripping non-printable characters in shell prompt scripts
Remediation Steps
- 1
Update Bash-it
Upgrade to a patched version of Bash-it once available that sanitizes control characters before inserting external file content into PS1.
- 2
Sanitize prompt inputs
Strip non-printable/control characters (e.g., using tr -d or a regex filter) from any externally-sourced string before it is embedded in shell prompt variables.
- 3
Avoid parsing untrusted files for prompt content
Do not source values from files in arbitrary, potentially attacker-controlled directories (like project config files) directly into shell environment/display strings.
- 4
Use a hardened terminal emulator
Use terminal emulators that restrict or sandbox interpretation of risky OSC/CSI sequences from untrusted sources.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.