CVE-2021-3725CWE-78

OS Command Injection in ohmyzsh/ohmyzsh

High · published November 30, 2021

CVSS v3.1
7.5
EPSS
1%
Percentile
64.1
In the wild
Unconfirmed
What it is

Vulnerability in dirhistory plugin Description: the widgets that go back and forward in the directory history, triggered by pressing Alt-Left and Alt-Right, use functions that unsafely execute eval on directory names. If you cd into a directory with a carefully-crafted name, then press Alt-Left, the system is subject to command injection. Impacted areas: - Functions pop_past and pop_future in dirhistory plugin.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01052 · 64.1th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2021-11-30T09:30Z
EPSS history
Timeline
  • 30 NOV 09:30Z
    OS Command Injection in ohmyzsh/ohmyzsh
    cvelistv5