What’s Vulnerable › Vulnerabilities

CVE-2021-3725: OS Command Injection in ohmyzsh/ohmyzsh

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-11-30 · updated 2026-06-17
• Weakness: CWE-78

Description

Vulnerability in dirhistory plugin Description: the widgets that go back and forward in the directory history, triggered by pressing Alt-Left and Alt-Right, use functions that unsafely execute eval on directory names. If you cd into a directory with a carefully-crafted name, then press Alt-Left, the system is subject to command injection. Impacted areas: - Functions pop_past and pop_future in dirhistory plugin.

Affected products

• ohmyzsh/ohmyzsh: before 11-11-2021 — fixed in 11-11-2021

How to fix

Upgrade to a fixed version: ohmyzsh/ohmyzsh 11-11-2021. Check the vendor advisory for mitigations.

References

• https://github.com/ohmyzsh/ohmyzsh/commit/06fc5fb
• https://github.com/ohmyzsh/ohmyzsh/commit/06fc5fb

Get alerted when CVE-2021-3725 or the next vulnerability affects your stack