PT-2026-21303 · Unknown · Liquidprompt

Trey-Crystalpeak · Published 2026-02-20 · Updated 2026-04-22 · CVE-2026-27113

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Liquid Prompt (affected versions not specified)

Description Liquid Prompt, an adaptive prompt for Bash and Zsh, contains a flaw where arbitrary command injection can lead to code execution. This occurs when a user enters a directory within a Git repository that has a specially crafted branch name. The issue requires the LP ENABLE GITSTATUSD configuration option to be enabled, gitstatusd to be installed and running before Liquid Prompt is loaded, and shell prompt substitution to be active. A branch name containing shell syntax, such as $(...) or backtick expressions, in either the default or a checked-out branch will be evaluated by the shell when the prompt is rendered. The vulnerable code exists between commit cf3441250bb5d8b45f6f8b389fcdf427a99ac28a and prior to commit a4f6b8d8c90b3eaa33d13dfd1093062ab9c4b30c on the master branch.

Recommendations Set the LP ENABLE GITSTATUSD configuration option to 0.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-27113

GHSA-Q6HM-VF4F-47JF

Affected Products

Liquidprompt

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27113.json · Exploit
• https://ubuntu.com/security/CVE-2026-27113 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-27113 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27113 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27113 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27113 · Vendor Advisory
• https://github.com/liquidprompt/liquidprompt/security/advisories/GHSA-q6hm-vf4f-47jf · Note
• https://github.com/liquidprompt/liquidprompt/commit/a4f6b8d8c90b3eaa33d13dfd1093062ab9c4b30c · Note
• https://twitter.com/CVEnew/status/2024988743908880496 · Twitter Post
• https://twitter.com/ai_security_10x/status/2047025848981815802 · Twitter Post