CVE-2021-3727

# Vulnerability in `rand-quote` and `hitokoto` plugins **Description**: the `rand-quote` and `hitokoto` fetch quotes from quotationspage.com and hitokoto.cn respectively, do some process on them and then use `print -P` to print them. If these quotes contained the proper symbols, they could trigger command injection. Given that they're an external API, it's not possible to know if the quotes are safe to use. **Fixed in**: [72928432](https://github.com/ohmyzsh/ohmyzsh/commit/72928432). **Impacted areas**: - `rand-quote` plugin (`quote` function). - `hitokoto` plugin (`hitokoto` function).

• CWE-78

• https://github.com/ohmyzsh/ohmyzsh/commit/72928432Patch, Third Party Advisory
• https://github.com/ohmyzsh/ohmyzsh/commit/72928432Patch, Third Party Advisory

Published

Nov 30, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3725Vulnerability in dirhistory plugin Description: the widgets …8.8
• CVE-2021-37253M-Files Web before 20.10.9524.1 allows a denial of service v…7.5
• CVE-2021-37254In M-Files Web product with versions before 20.10.9524.1 and…7.5
• CVE-2021-3726# Vulnerability in `title` function **Description**: the `ti…9.8
• CVE-2021-37262JFinal_cms 5.1.0 is vulnerable to regex injection that may l…7.5
• CVE-2021-37267Cross Site Scripting (XSS) vulnerability exists in all versi…6.1
• CVE-2021-37270There is an unauthorized access vulnerability in the CMS Ent…9.8
• CVE-2021-37271Cross Site Scripting (XSS) vulnerability exists in UEditor v…5.4
• CVE-2021-37273A Denial of Service issue exists in China Telecom Corporatio…7.5
• CVE-2021-37274Kingdee KIS Professional Edition has a privilege escalation …8.8
• CVE-2021-3728firefly-iii is vulnerable to Cross-Site Request Forgery (CSR…6.5
• CVE-2021-37289Insecure Permissions in administration interface in Planex M…7.2