CVE-2021-4326: Linuxfoundation Zowe

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

A vulnerability in Imperative framework which allows already-privileged local actors to execute arbitrary shell commands via plugin install/update commands, or maliciously formed environment variables. Impacts Zowe CLI.

Affected products

• Linuxfoundation Zowe: from 1.16.0, before 1.28.2 (fixed in 1.28.2); from 2.0.0, before 2.5.0 (fixed in 2.5.0)

Published 2023-03-01. Last modified 2026-06-17.