CVE-2021-3727: Planetargon Oh My Zsh

Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days.

# Vulnerability in `rand-quote` and `hitokoto` plugins **Description**: the `rand-quote` and `hitokoto` fetch quotes from quotationspage.com and hitokoto.cn respectively, do some process on them and then use `print -P` to print them. If these quotes contained the proper symbols, they could trigger command injection. Given that they're an external API, it's not possible to know if the quotes are safe to use. **Fixed in**: [72928432](https://github.com/ohmyzsh/ohmyzsh/commit/72928432). **Impacted areas**: - `rand-quote` plugin (`quote` function). - `hitokoto` plugin (`hitokoto` function).

Affected products

• Planetargon Oh My Zsh: before 72928432 (fixed in 72928432)

Published 2021-11-30. Last modified 2026-06-17.