Zsh: Prompt Expansion Vulnerability — GLSA 202407-01

A vulnerability has been discovered in Zsh, which can lead to execution of arbitrary code.

Package	app-shells/zsh on all architectures
Affected versions	< 5.8.1
Unaffected versions	>= 5.8.1

A shell designed for interactive use, although it is also a powerful scripting language.

Multiple vulnerabilities have been discovered in Zsh. Please review the CVE identifiers referenced below for details.

A vulnerability in prompt expansion could be exploited through e.g. VCS_Info to execute arbitrary shell commands without a user's knowledge.

There is no known workaround at this time.

All Zsh users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=app-shells/zsh-5.8.1"

Release date
July 01, 2024

Latest revision
July 01, 2024: 1

Severity
normal

Exploitable
local

Bugzilla entries