Vulnerability · Published Dec 14, 2021 · Assigned by Zoom
CVE-2021-34426Arbitrary command execution in Keybase Client for Windows
Medium 5.3
In plain English
A medium-severity security flaw in Keybase Client for Windows from Zoom Video Communications Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 84.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A vulnerability was discovered in the Keybase Client for Windows before version 5.6.0 when a user executed the "keybase git lfs-config" command on the command-line. In versions prior to 5.6.0, a malicious actor with write access to a user\'s Git repository could leverage this vulnerability to potentially execute arbitrary Windows commands on a user\'s local system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Zoom Video Communications Inc | Keybase Client for Windows | unspecified – before 5.6.0 |
References
- https://explore.zoom.us/en/trust/security/security-bulletin x_refsource_MISC