CVE-2024-41815
High
Description
Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone. Version 1.20.0 fixes the vulnerability.
SeverityHigh
CVSS7.4
Exploit probability—
ProductStarship
PublishedJul 26, 2024
First seenJul 26, 2024
Weakness typeCWE-77Command injection
How to fix
Update
- starship starship1.20.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| starship starship | 1.0.0 ≤ v < 1.20.0 | 1.20.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.