CVE-2021-3725: Vulnerability in dirhistory plugin Description: the widgets that go back and forward in the directory history,

Q: How do I fix CVE-2021-3725?

oh my zsh: upgrade to 11-11-2021. Exact commands for each OS are on this page.

Q: Is CVE-2021-3725 being exploited?

CVE-2021-3725 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2021-3725 affect?

CVE-2021-3725 affects oh my zsh. Severity is high (CVSS 7.5). Vulnerability in dirhistory plugin Description: the widgets that go back and forward in the directory history, triggered by pressing Alt-Left and Alt-Right, use functions that unsafely execute eval on directory names. If you cd into a direc

This month

HIGH 7.5UPGRADE

CVE-2021-3725 is a high-severity flaw (CVSS 7.5) affecting oh my zsh. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Vulnerability in dirhistory plugin Description: the widgets that go back and forward in the directory history, triggered by pressing Alt-Left and Alt-Right, use functions that unsafely execute eval on directory names. If you cd into a directory with a carefully-crafted name, then press Alt-Left, the system is subject to command injection. Impacted areas: - Functions pop_past and pop_future in dirhistory plugin.

Why this priority

High severity

A fixed release or distro patch exists.

Risk facts

CVSS score	7.5 (High)
Attack vector	Network (remote)
Attack complexity	High
Privileges needed	None
User interaction	Required
EPSS exploit chance	1.1% (top 36%)
CISA exploited list	No
Weakness	CWE-78, CWE-94
Published	2021-11-30
Last modified	2026-06-17

Publisher (CNA): huntr.dev · Vendor: planetargon

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2021-11-30 10:15 UTCPublished CVE record published
2026-06-17 04:05 UTCUpdated Record last modified

planetargon oh my zsh UPGRADE

Affected: < 11-11-2021

Fixed in: 11-11-2021

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy oh-my-zsh || rpm -q oh-my-zsh || oh-my-zsh --version

2. UPGRADE to 11-11-2021 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade oh-my-zsh

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade oh-my-zsh

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2021-3725?

oh my zsh: upgrade to 11-11-2021. Exact commands for each OS are on this page.

Is CVE-2021-3725 being exploited?

CVE-2021-3725 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2021-3725 affect?

CVE-2021-3725 affects oh my zsh. Severity is high (CVSS 7.5). Vulnerability in dirhistory plugin Description: the widgets that go back and forward in the directory history, triggered by pressing Alt-Left and Alt-Right, use functions that unsafely execute eval on directory names. If you cd into a direc

How urgent is CVE-2021-3725?

Priority 42/100. High severity

Related CVEs

CVE-2021-3934 HIGH 7.5 UPGRADE ohmyzsh is vulnerable to Improper Neutralization of Special Elements used in an OS Command
CVE-2021-3769 HIGH 7.5 UPGRADE # Vulnerability in `pygmalion`, `pygmalion-virtualenv` and `refined` themes **Description**: these themes use
CVE-2021-3727 HIGH 7.5 UPGRADE # Vulnerability in `rand-quote` and `hitokoto` plugins **Description**: the `rand-quote` and `hitokoto` fetch
CVE-2021-3726 HIGH 7.5 UPGRADE # Vulnerability in `title` function **Description**: the `title` function defined in `lib/termsupport.zsh` use

References

← Back to latest CVEs