Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone. Version 1.20.0 fixes the vulnerability.
References
| Link | Resource |
|---|---|
| https://github.com/starship/starship/security/advisories/GHSA-vx24-x4mv-vwr5 | Exploit Vendor Advisory |
| https://github.com/starship/starship/commit/cfc58161e0ec595db90af686ad77a73df6d44d74 | Patch |
| https://github.com/starship/starship/releases/tag/v1.20.0 | Release Notes |
Configurations
History
19 Sep 2024, 14:36
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.0 |
| CWE | CWE-78 | |
| First Time |
Starship
Starship starship |
|
| CPE | cpe:2.3:a:starship:starship:*:*:*:*:*:*:*:* | |
| References | () https://github.com/starship/starship/commit/cfc58161e0ec595db90af686ad77a73df6d44d74 - Patch | |
| References | () https://github.com/starship/starship/releases/tag/v1.20.0 - Release Notes | |
| References | () https://github.com/starship/starship/security/advisories/GHSA-vx24-x4mv-vwr5 - Exploit, Vendor Advisory |
26 Jul 2024, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-07-26 21:15
Updated : 2024-09-19 14:36
NVD link : CVE-2024-41815
Mitre link : CVE-2024-41815
JSON object : View
Products Affected
starship
- starship
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')