Vulnerability · Published Nov 30, 2021 · Assigned by @huntrdev

CVE-2021-3769OS Command Injection in ohmyzsh/ohmyzsh

High 7.5

In plain English

A high-severity OS command injection in ohmyzsh/ohmyzsh from ohmyzsh. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.0%top 37.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

# Vulnerability in `pygmalion`, `pygmalion-virtualenv` and `refined` themes **Description**: these themes use `print -P` on user-supplied strings to print them to the terminal. All of them do that on git information, particularly the branch name, so if the branch has a specially-crafted name the vulnerability can be exploited. **Fixed in**: [b3ba9978](https://github.com/ohmyzsh/ohmyzsh/commit/b3ba9978). **Impacted areas**: - `pygmalion` theme. - `pygmalion-virtualenv` theme. - `refined` theme.

Affected products (as reported)

Vendor	Product	Versions
ohmyzsh	ohmyzsh/ohmyzsh	unspecified – before b3ba9978

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/ohmyzsh/ohmyzsh/commit/b3ba9978 x_refsource_MISC