CVE-2021-40084
opensysusers through 0.6 does not safely use eval on files in sysusers.d that may contain shell...
opensysusers through 0.6 does not safely use eval on files in sysusers.d that may contain shell metacharacters. For example, it allows command execution via a crafted GECOS field whereas systemd-sysusers (a program with the same specification) does not do that.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
opensysusers through 0.6 does not safely use eval on files in sysusers.d that may contain shell metacharacters. For example, it allows command execution via a crafted GECOS field whereas systemd-sysusers (a program with the same specification) does not do that.
- Record
CVE-2021-40084- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
opensysusers through 0.6 does not safely use eval on files in sysusers.d that may contain shell metacharacters. For example, it allows command execution via a crafted GECOS field whereas systemd-sysusers (a program with the same specification) does not do that.
- Record
CVE-2021-40084- Updated
- 2026-11-02
EUVDEUVD-2021-27274 No score
opensysusers through 0.6 does not safely use eval on files in sysusers.d that may contain shell metacharacters. For example, it allows command execution via a crafted GECOS field whereas systemd-sysusers (a program with the same specification) does not do that.
- Record
EUVD-2021-27274- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2hgh-26fm-566h
opensysusers through 0.6 does not safely use eval on files in sysusers.d that may contain shell...
opensysusers through 0.6 does not safely use eval on files in sysusers.d that may contain shell metacharacters. For example, it allows command execution via a crafted GECOS field whereas systemd-sysusers (a program with the same specification) does not do that.
- Record
GHSA-2hgh-26fm-566h- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
OSV
opensysusers through 0.6 does not safely use eval on files in sysusers.d that may contain shell metacharacters. For example, it allows command execution via a crafted GECOS field whereas systemd-sysusers (a program with the same specification) does not do that.
- Record
CVE-2021-40084- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-40084
opensysusers through 0.6 does not safely use eval on files in sysusers.d that may contain shell metacharacters. For example, it allows command execution via a crafted GECOS field whereas systemd-sysusers (a program with the same specification) does not do that.
- Record
DEBIAN-CVE-2021-40084- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-40084
opensysusers through 0.6 does not safely use eval on files in sysusers.d that may contain shell metacharacters. For example, it allows command execution via a crafted GECOS field whereas systemd-sysusers (a program with the same specification) does not do that.
- Record
UBUNTU-CVE-2021-40084- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opensysusersDebian:12 |
before 0.6-3 | 0.6-3 |
opensysusersDebian:13 |
before 0.6-3 | 0.6-3 |
opensysusersDebian:14 |
before 0.6-3 | 0.6-3 |
opensysusersUbuntu:20.04:LTS |
All versions, plus listed versions 0.5.1-1 |
None known |
opensysusersUbuntu:22.04:LTS |
All versions, plus listed versions 0.6-20.6-3 |
None known |
opensysusersUbuntu:24.04:LTS |
All versions, plus listed versions 0.7.3-2 |
None known |
opensysusersUbuntu:25.10 |
All versions, plus listed versions 0.7.3-4.10.7.3-5 |
None known |
opensysusersUbuntu:26.04:LTS |
All versions, plus listed versions 0.7.3-50.7.3-5.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-40084 is a critical vulnerability (CVSS 9.8) in Artixlinux Opensysusers, published August 25, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.93%, the 87th percentile. Fixed in opensysusers 0.6-3.