CVE-2024-41815

Katalog CVE

CVSS 7.0 · High EPSS 0,46%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada starship. Skor CVSS 3.1 7.0 (High) menurut NVD.

Deskripsi (NVD)

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone. Version 1.20.0 fixes the vulnerability.

Rincian

Terbit di NVD

26 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.0 (High), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 38,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/starship/starship/security/advisories/GHSA-vx24-x4mv-vwr5 exploit · advisory vendor
• https://github.com/starship/starship/commit/cfc58161e0ec595db90af686ad77a73df6d44d74 patch
• https://github.com/starship/starship/releases/tag/v1.20.0 release notes