RCE in Ohmyzsh Ohmyzsh/ohmyzsh
CVE-2021-3769
# Vulnerability in `pygmalion`, `pygmalion-virtualenv` and `refined` themes **Description**: these themes use `print -P` on user-supplied strings to print them to the terminal. All of them do that on git information, particularly the branch name, so if the branch has a specially-crafted name the vulnerability can be exploited. **Fixed in**: [b3ba9978](https://github.com/ohmyzsh/ohmyzsh/commit/b3ba9978). **Impacted areas**: - `pygmalion` theme. - `pygmalion-virtualenv` theme. - `refined` theme.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.009 (57.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Ohmyzsh Ohmyzsh/ohmyzsh — versions unspecified
- Planetargon Oh_my_zsh
Weakness classification (CWE)
References
- security@huntr.dev (Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2021-3769?
- CVE-2021-3769 is a high-severity vulnerability in Ohmyzsh Ohmyzsh/ohmyzsh, classified under OS Command Injection. CVSS score: 7.5/10. Published 2021-11-30.
- How severe is CVE-2021-3769?
- High severity. CVSS v3 base score is 7.5 out of 10.