Vulnerability · Published Nov 30, 2021 · Assigned by @huntrdev

CVE-2021-3726OS Command Injection in ohmyzsh/ohmyzsh

High 7.5

In plain English

A high-severity OS command injection in ohmyzsh/ohmyzsh from ohmyzsh. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.8%top 42.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

# Vulnerability in `title` function **Description**: the `title` function defined in `lib/termsupport.zsh` uses `print` to set the terminal title to a user-supplied string. In Oh My Zsh, this function is always used securely, but custom user code could use the `title` function in a way that is unsafe. **Fixed in**: [a263cdac](https://github.com/ohmyzsh/ohmyzsh/commit/a263cdac). **Impacted areas**: - `title` function in `lib/termsupport.zsh`. - Custom user code using the `title` function.

Affected products (as reported)

Vendor	Product	Versions
ohmyzsh	ohmyzsh/ohmyzsh	unspecified – before a263cdac

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/ohmyzsh/ohmyzsh/commit/a263cdac x_refsource_MISC