CVE-2021-3013 OS command injection in ripgrep
Attackers can execute arbitrary programs via specific flags in ripgrep on Windows, posing a risk to developers using the tool.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-3013?
CVE-2021-3013 is a critical command injection vulnerability in n/a, published on 11 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ripgrep before 13 on Windows allows attackers to trigger execution of arbitrary programs from the current working directory via the -z/--search-zip or --pre flag.
Which versions are affected by CVE-2021-3013?
5 open source packages ship an affected version, including grep-cli and ripgrep. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
grep-cli crates.io | All versions | 0.1.6 |
grep-cli crates.io | All versions | 0.1.6 |
grep-cli crates.io | From 0.0.0-0 | 0.1.6 |
ripgrep crates.io | All versions | 13.0.0 |
ripgrep crates.io | All versions | 13.0.0 |
Linux distribution packages (1)
ripgrep openSUSE:Tumbleweed | All versions | 13.0.0-2.2 |
Products include Ripgrep Project Ripgrep.
How do I fix CVE-2021-3013?
Upgrade grep-cli to 0.1.6 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-3013 being exploited?
There is no known exploitation of CVE-2021-3013 in the wild and no public exploit code.
Sources
Also known as GHSA-g4xg-fxmg-vcg5, RUSTSEC-2021-0071, UBUNTU-CVE-2021-3013, openSUSE-SU-2024:11300-1.