In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs because of recursive PROMPT_SUBST expansion.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade zsh-htmlUpgrade zsh | May 13, 2022 | Feb 14, 2022 |
| Alpine Linux | — | Upgrade zsh | Mar 26, 2024 | Feb 13, 2022 |
| Amazon Linux Ami 2 | — | Upgrade zsh-debuginfoUpgrade zsh-htmlUpgrade zsh | Jul 4, 2022 | Feb 14, 2022 |
| Amazon_linux_2023 | — | Upgrade zsh-htmlUpgrade zsh-debugsourceUpgrade zsh-debuginfoUpgrade zsh | Feb 17, 2025 | Feb 12, 2022 |
| Apple Osx Amd | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Apache | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Appkit | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Appleavd | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Appleevents | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Applegraphicscontrol | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Applemobilefileintegrity | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Applescript | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Avevideoencoder | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Bluetooth | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Contacts | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Coretypes | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Cvms | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Driverkit | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Facetime | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Graphicsdrivers | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Imageio | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Intelgraphicsdriver | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Iokit | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Iomobileframebuffer | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Kernel | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Launchservices | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Libinfo | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Libresolv | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Libressl | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Libxml2 | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Loginwindow | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Openssl | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Packagekit | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Photobooth | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Preview | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Printing | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Safariprivatebrowsing | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Security | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Smb | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Softwareupdate | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Spotlight | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Systempreferences | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Tcc | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Tcl | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Terminal | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Vim | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Webkit | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Webrtc | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Wifi | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Zip | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Zlib | — | — | Oct 14, 2024 | Feb 14, 2022 |
| Apple Osx Zsh | — | Upgrade macOS to the latest versionApply Apple macOS Security Update 2022-004 Catalina | May 17, 2022 | May 16, 2022 |
| Centos_linux | — | Upgrade zsh-debugsourceUpgrade zsh-htmlUpgrade zsh-debuginfoUpgrade zsh | May 13, 2022 | Feb 14, 2022 |
| Debian | — | Upgrade zsh | Feb 18, 2022 | Feb 14, 2022 |
| Freebsd | — | Upgrade zsh | Nov 4, 2022 | Feb 12, 2022 |
| Gentoo Linux | — | Upgrade app-shells/zsh. | Jul 3, 2024 | Feb 14, 2022 |
| Huawei Euleros 2_0_sp3 | — | Upgrade zsh | May 25, 2022 | Feb 14, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade zsh | Apr 26, 2022 | Feb 14, 2022 |
| Oracle_linux | — | Upgrade zshUpgrade zsh-html | May 18, 2022 | Feb 12, 2022 |
| Redhat_linux | — | Upgrade zshUpgrade zsh-debuginfoUpgrade zsh-htmlUpgrade zsh-debugsource | May 13, 2022 | Feb 14, 2022 |
| Rocky_linux | — | Upgrade zshUpgrade zsh-debugsourceUpgrade zsh-debuginfo | Mar 5, 2024 | Feb 14, 2022 |
| Suse | — | Upgrade zsh-htmldocUpgrade zsh | Mar 5, 2022 | Feb 14, 2022 |
| Ubuntu | — | Upgrade zsh-static (Ubuntu Pro)Upgrade zsh (Ubuntu Pro)Upgrade zsh-staticUpgrade zsh | Mar 15, 2022 | Feb 14, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 13, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub