CVE-2021-40084: Artixlinux Opensysusers

Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days.

opensysusers through 0.6 does not safely use eval on files in sysusers.d that may contain shell metacharacters. For example, it allows command execution via a crafted GECOS field whereas systemd-sysusers (a program with the same specification) does not do that.

Affected products

• Artixlinux Opensysusers: up to and including 0.6

Published 2021-08-25. Last modified 2026-06-17.