PT-2021-21590 · Unknown · Dirhistory Plugin

Published 2021-11-30 · Updated 2022-08-09 · CVE-2021-3725

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions dirhistory plugin (affected versions not specified)

Description The issue concerns the widgets for navigating directory history, triggered by pressing Alt-Left and Alt-Right. These widgets use functions that unsafely execute eval on directory names, making the system susceptible to command injection if a directory with a carefully crafted name is accessed and then the Alt-Left key is pressed. The impacted areas include the pop past and pop future functions in the dirhistory plugin.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

OS Command Injection

Weakness Enumeration

CWE-94

CWE-78

Related Identifiers

CVE-2021-3725

Affected Products

Dirhistory Plugin

References · 5

• https://github.com/ohmyzsh/ohmyzsh/commit/06fc5fb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-3725 · Security Note
• https://osv.dev/vulnerability/CVE-2021-3725 · Vendor Advisory
• https://t.me/cibsecurity/33078 · Telegram Post
• https://t.me/cvenotify/34442 · Telegram Post