CVE-2021-40084

9.8 criticalEPSS 2.9%

Critical (9.8) in artixlinux opensysusers. EPSS 2.9% chance of exploitation in the next 30 days.

opensysusers through 0.6 does not safely use eval on files in sysusers.d that may contain shell metacharacters. For example, it allows command execution via a crafted GECOS field whereas systemd-sysusers (a program with the same specification) does not do that.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.9% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2021-08-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

artixlinux:opensysusers

References

https://bugs.debian.org/992058
https://github.com/artix-linux/opensysusers/releases
https://bugs.debian.org/992058
https://github.com/artix-linux/opensysusers/releases

Check your stack JSON