CVE-2021-45444

In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument

published February 13, 2022

CVSS
—
EPSS
2%
Percentile
80.4
In the wild
Unconfirmed
What it is

In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01980 · 80.4th percentile
Published
2022-02-13T05:32Z
EPSS history
Timeline
  • 13 FEB 05:32Z
    In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument
    cvelistv5