CVE-2021-3727
OS Command Injection in ohmyzsh/ohmyzsh
- State
- Published
- Severity
- 7.5 High
- Published
- Nov 30, 2021
- Updated
- Aug 3, 2024
- Reserved
- Aug 19, 2021
Description
# Vulnerability in `rand-quote` and `hitokoto` plugins **Description**: the `rand-quote` and `hitokoto` fetch quotes from quotationspage.com and hitokoto.cn respectively, do some process on them and then use `print -P` to print them. If these quotes contained the proper symbols, they could trigger command injection. Given that they're an external API, it's not possible to know if the quotes are safe to use. **Fixed in**: [72928432](https://github.com/ohmyzsh/ohmyzsh/commit/72928432). **Impacted areas**: - `rand-quote` plugin (`quote` function). - `hitokoto` plugin (`hitokoto` function).
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H | @huntrdev |
Weaknesses
- CWE-78 OS Command Injection
Affected Products
| Product | Versions |
|---|---|
ohmyzsh/ohmyzshohmyzsh |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.