Skip to content
OpenAdvisories
High · 7.5 CVE-2021-3727 EUVD-2021-27007GHSA-vg23-f593-6r27

OS Command Injection in ohmyzsh/ohmyzsh

Published Nov 30, 2021 · Updated Aug 3, 2024 · Assigned by @huntrdev

Description

# Vulnerability in `rand-quote` and `hitokoto` plugins **Description**: the `rand-quote` and `hitokoto` fetch quotes from quotationspage.com and hitokoto.cn respectively, do some process on them and then use `print -P` to print them. If these quotes contained the proper symbols, they could trigger command injection. Given that they're an external API, it's not possible to know if the quotes are safe to use. **Fixed in**: [72928432](https://github.com/ohmyzsh/ohmyzsh/commit/72928432). **Impacted areas**: - `rand-quote` plugin (`quote` function). - `hitokoto` plugin (`hitokoto` function).

Affected products

VendorProductAffectedFixed
ohmyzsh ohmyzsh/ohmyzsh unspecified – < 72928432 72928432

References