What’s Vulnerable › Vulnerabilities

CVE-2021-3934: OS Command Injection in ohmyzsh/ohmyzsh

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-11-12 · updated 2026-06-17
• Weakness: CWE-78

Description

ohmyzsh is vulnerable to Improper Neutralization of Special Elements used in an OS Command

Affected products

• ohmyzsh/ohmyzsh: before 2021-11-11 — fixed in 2021-11-11

How to fix

Upgrade to a fixed version: ohmyzsh/ohmyzsh 2021-11-11. Check the vendor advisory for mitigations.

References

• https://github.com/ohmyzsh/ohmyzsh/commit/6cb41b70a6d04301fd50cd5862ecd705ba226c0e
• https://huntr.dev/bounties/ad2b5c3f-a3ce-4407-94dc-354c723310ce
• https://github.com/ohmyzsh/ohmyzsh/commit/6cb41b70a6d04301fd50cd5862ecd705ba226c0e
• https://huntr.dev/bounties/ad2b5c3f-a3ce-4407-94dc-354c723310ce

Get alerted when CVE-2021-3934 or the next vulnerability affects your stack