title: OS Command Injection in ohmyzsh/ohmyzsh
description: # Vulnerability in `title` function **Description**: the `title` function defined in `lib/termsupport.zsh` uses `print` to set the terminal title to a user-supplied string. In Oh My Zsh, this function is always used securely, but custom user code could use the `title` function in a way that is unsafe. **Fixed in**: [a263cdac](https://github.com/ohmyzsh/ohmyzsh/commit/a263cdac). **Impacted areas**: - `title` function in `lib/termsupport.zsh`. - Custom user code using the `title` function.
problem types: CWE-78 OS Command Injection
affected:
{
product: ohmyzsh/ohmyzsh
vendor: ohmyzsh
versions:
lessThan: a263cdac, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
exploits: **Exploit PoC**:
1. Install Oh My Zsh.
2. Add a custom function that calls `title` to set the terminal title with a user-supplied string.
For example:
```sh
function dirpath_in_title {
title "$PWD"
}
add-zsh-hook precmd dirpath_in_title
```
3. Create and cd into a directory with a subshell command as its name:
```sh
baddir='`echo pwned && id`'
mkdir "$baddir" && cd "$baddir"
```
4. The `title` function incorrectly expands the subshell command (see screenshot):
![2 title_function poc](https://user-images.githubusercontent.com/1441704/142874935-341ddd3c-21e8-4b9e-a5c1-77c0b3debacc.png)