CVE-2021-3727 OS Command Injection in ohmyzsh/ohmyzsh
Attackers can execute arbitrary commands via malicious quotes fetched by rand-quote and hitokoto plugins in Oh My Zsh.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-3727?
CVE-2021-3727 is a high-severity command injection vulnerability in ohmyzsh/ohmyzsh, published on 30 Nov 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
# Vulnerability in `rand-quote` and `hitokoto` plugins **Description**: the `rand-quote` and `hitokoto` fetch quotes from quotationspage.com and hitokoto.cn respectively, do some process on them and then use `print -P` to print them. If these quotes contained the proper symbols, they could trigger command injection. Given that they're an external API, it's not possible to know if the quotes are safe to use. **Fixed in**: [72928432](https://github.com/ohmyzsh/ohmyzsh/commit/72928432). **Impacted areas**: - `rand-quote` plugin (`quote` function). - `hitokoto` plugin (`hitokoto` function).
Weakness: CWE-78
Which versions are affected by CVE-2021-3727?
It affects 1 product.
Products include Planetargon Oh My Zsh.
How do I fix CVE-2021-3727?
No fix has been published for CVE-2021-3727 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-3727 being exploited?
There is no known exploitation of CVE-2021-3727 in the wild and no public exploit code.
Other vulnerabilities in ohmyzsh/ohmyzsh
Sources
Also known as GHSA-vg23-f593-6r27.