Feb. 14, 2022, 12:15 p.m. |

National Vulnerability Database web.nvd.nist.gov

In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion.

cve fedora macos zsh

Information Security Engineers

@ D. E. Shaw Research | New York City

Technology Security Analyst

@ Halton Region | Oakville, Ontario, Canada

Senior Cyber Security Analyst

@ Valley Water | San Jose, CA

Associate Engineer (Security Operations Centre)

@ People Profilers | Singapore, Singapore, Singapore

DevSecOps Engineer

@ Australian Payments Plus | Sydney, New South Wales, Australia

Senior Cybersecurity Specialist

@ SmartRecruiters Inc | Poland, Poland