CVE-2021-3934 HIGH

CVE-2021-3934: OS Command Injection in ohmyzsh/ohmyzsh

Vendor Ohmyzsh
Product ohmyzsh/ohmyzsh
Weakness CWE-78
Published November 12, 2021
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

7.8/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

ohmyzsh is vulnerable to Improper Neutralization of Special Elements used in an OS Command

Key dates

02Disclosure timeline

November 12, 2021 CVE published
August 3, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-28507 Idno: Remote Code Execution via Chained Import File Write and Template Path Traversal CVE-2026-8191 Wavlink NU516U1 adm.cgi wifi_region os command injection CVE-2022-20865 Cisco FXOS Software Command Injection Vulnerability CVE-2024-42370 Litestar repository vulnerable to Environment Variable injection in `docs-preview.yml` workflow CVE-2026-27728 OneUptime: OS Command Injection in Probe NetworkPathMonitor via unsanitized destination in traceroute exec()