CVE-2024-41815 HIGH

CVE-2024-41815: Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

Vendor Starship

Product starship

Weakness CWE-77

Published July 26, 2024

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

7.4/10

Attack vector Local

Attack complexity High

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone. Version 1.20.0 fixes the vulnerability.

Key dates

02Disclosure timeline

July 26, 2024 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-41815 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/77.html