Skip to content

GitLab

Closed
Created by Zach van Rijn@zOwner

system/zsh: CVE-2021-45444: an attacker can achieve code execution if they control a command output inside the prompt

Name Description
CVE-2021-45444 In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion.