CVE-2024-41815
Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands
Impact
## Description Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability. ### PoC Have some custom command which prints out information from a potentially untrusted/unverified source. ``` [custom.git_commit_name] command = 'git show -s --format="%<(25,mtrunc)%s"' style = "italic" when = true ``` ### Impact This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rust | starship | >= 1.0.0, <= 1.19.0 | 1.20.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Starship | Starship | from 1.0.0 before 1.20.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/starship/starship/commit/cfc58161e0ec595db90af686ad77a73df6d44d74
- https://github.com/starship/starship/releases/tag/v1.20.0
- https://github.com/starship/starship/security/advisories/GHSA-vx24-x4mv-vwr5
- https://github.com/advisories/GHSA-vx24-x4mv-vwr5
- https://nvd.nist.gov/vuln/detail/CVE-2024-41815
- https://rustsec.org/advisories/RUSTSEC-2024-0446.html