CVE-2021-3934

This entry is deliberately thin, so we read it conservatively. oh-my-zsh, the popular zsh configuration framework, fails to neutralize special elements in an OS command somewhere in its scripting. The CVSS vector is the most informative part: high attack complexity plus required user interaction means the flaw does not fire on its own — it needs a victim to perform an action that routes attacker-controlled input into the vulnerable command.

Because oh-my-zsh executes inside a user's own interactive shell, "OS command injection" lands at that user's existing privilege level, not root-out-of-nowhere. The believable scenario is a hostile value — a directory name, repository, or branch — flowing into a command that runs when the user enters a booby-trapped checkout. That's a real trap for developers, but it's opportunistic and interaction-gated, which is exactly why the complexity and UI requirements keep it off the critical tier despite the scary CWE.

With so few specifics in the record, our posture is developer-environment inventory rather than alarm. oh-my-zsh lives in dotfiles and CI base images, not typically in inventoried production, so the work is spotting where a vulnerable revision is baked into build or workstation setups and bumping it. We rank it as workstation/CI hygiene and explicitly avoid inflating an underspecified shell-framework bug into an internet-facing threat the data doesn't support.