CVE-2021-3727: OS Command Injection in ohmyzsh/ohmyzsh

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-11-30 · updated 2026-06-17
Weakness: CWE-78

Description

# Vulnerability in `rand-quote` and `hitokoto` plugins **Description**: the `rand-quote` and `hitokoto` fetch quotes from quotationspage.com and hitokoto.cn respectively, do some process on them and then use `print -P` to print them. If these quotes contained the proper symbols, they could trigger command injection. Given that they're an external API, it's not possible to know if the quotes are safe to use. **Fixed in**: [72928432](https://github.com/ohmyzsh/ohmyzsh/commit/72928432). **Impacted areas**: - `rand-quote` plugin (`quote` function). - `hitokoto` plugin (`hitokoto` function).

Affected products

ohmyzsh/ohmyzsh: before 72928432 — fixed in 72928432

How to fix

Upgrade to a fixed version: ohmyzsh/ohmyzsh 72928432. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-3727 or the next vulnerability affects your stack