CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2021-3013
Critical (9.8) in ripgrep project ripgrep. EPSS 1.9% chance of exploitation in the next 30 days. Fixed in ripgrep 13.0.0.
ripgrep before 13 on Windows allows attackers to trigger execution of arbitrary programs from the current working directory via the -z/--search-zip or --pre flag.
Severity
- EPSS
- 1.9% chance of exploitation in the next 30 days; higher than 80% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ripgrep_project:ripgrep
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-g4xg-fxmg-vcg5 | crates.io | ripgrep | <13.0.0 | 13.0.0 |
| GHSA-g4xg-fxmg-vcg5 | crates.io | grep-cli | <0.1.6 | 0.1.6 |
| RUSTSEC-2021-0071 | crates.io | grep-cli | >=0.0.0-0 <0.1.6 | 0.1.6 |
References
- https://github.com/BurntSushi/ripgrep/blob/e48a17e1891e1ea9dd06ba0e48d5fb140ca7c0c4/CHANGELOG.md
- https://github.com/BurntSushi/ripgrep/blob/master/CHANGELOG.md
- https://github.com/BurntSushi/ripgrep/blob/e48a17e1891e1ea9dd06ba0e48d5fb140ca7c0c4/CHANGELOG.md
- https://github.com/BurntSushi/ripgrep/blob/master/CHANGELOG.md