CVE-2021-3725

8.8 highEPSS 1.1%

High (8.8) in planetargon oh my zsh. EPSS 1.1% chance of exploitation in the next 30 days.

Vulnerability in dirhistory plugin Description: the widgets that go back and forward in the directory history, triggered by pressing Alt-Left and Alt-Right, use functions that unsafely execute eval on directory names. If you cd into a directory with a carefully-crafted name, then press Alt-Left, the system is subject to command injection. Impacted areas: - Functions pop_past and pop_future in dirhistory plugin.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 1.1% chance of exploitation in the next 30 days; higher than 64% of CVEs (scores of 2026-10-31)
CWEs: CWE-94, CWE-78
Published: 2021-11-30
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

planetargon:oh_my_zsh

References

https://github.com/ohmyzsh/ohmyzsh/commit/06fc5fb
https://github.com/ohmyzsh/ohmyzsh/commit/06fc5fb

Check your stack JSON