https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-3769.htmlhttps://patchthecve.com/cve/CVE-2021-3769.htmlWed, 17 Jun 2026 04:05:43 +0000HIGH 7.5: # Vulnerability in `pygmalion`, `pygmalion-virtualenv` and `refined` themes **Description**: these themes use `print -P` on user-supplied strings to print them to the terminal. All of them do that on git information, particularly the branch name, so if the branch has a specially-crafted name the vulhttps://patchthecve.com/cve/CVE-2021-3727.htmlhttps://patchthecve.com/cve/CVE-2021-3727.htmlWed, 17 Jun 2026 04:05:38 +0000HIGH 7.5: # Vulnerability in `rand-quote` and `hitokoto` plugins **Description**: the `rand-quote` and `hitokoto` fetch quotes from quotationspage.com and hitokoto.cn respectively, do some process on them and then use `print -P` to print them. If these quotes contained the proper symbols, they could trigger chttps://patchthecve.com/cve/CVE-2021-3726.htmlhttps://patchthecve.com/cve/CVE-2021-3726.htmlWed, 17 Jun 2026 04:05:38 +0000HIGH 7.5: # Vulnerability in `title` function **Description**: the `title` function defined in `lib/termsupport.zsh` uses `print` to set the terminal title to a user-supplied string. In Oh My Zsh, this function is always used securely, but custom user code could use the `title` function in a way that is unsafhttps://patchthecve.com/cve/CVE-2021-3725.htmlhttps://patchthecve.com/cve/CVE-2021-3725.htmlWed, 17 Jun 2026 04:05:38 +0000HIGH 7.5: Vulnerability in dirhistory plugin Description: the widgets that go back and forward in the directory history, triggered by pressing Alt-Left and Alt-Right, use functions that unsafely execute eval on directory names. If you cd into a directory with a carefully-crafted name, then press Alt-Left, thehttps://patchthecve.com/cve/CVE-2021-3934.htmlhttps://patchthecve.com/cve/CVE-2021-3934.htmlWed, 17 Jun 2026 04:06:00 +0000HIGH 7.5: ohmyzsh is vulnerable to Improper Neutralization of Special Elements used in an OS Command