CVE-2021-45444 describes a critical code execution vulnerability in zsh versions prior to 5.8.1, impacting products like Apple, Debian, and Fedora. An attacker can exploit this by controlling command output within the prompt, leveraging recursive PROMPT_SUBST expansion. With a CVSS score of 7.8 (High), this vulnerability allows for high impact to confidentiality, integrity, and availability with low attack complexity, requiring user interaction. While no public exploits (Metasploit, Nuclei, ExploitDB) or active exploitation (KEV) have been identified, and community discussion is minimal, the potential for severe consequences warrants attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 5.8.1CPE matchmatch criteria | cpe:2.3:a:zsh:zsh:*:*:*:*:*:*:*:* | ||
34CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | ||
35CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | ||
10.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
zsh: Prompt expansion vulnerability
Feb 12, 2022In zsh before 5.8.1 an attacker can achieve code execution if they control a command output inside the prompt as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion.
Feb 8, 2022