{"id":"CVE-2021-3013","aliases":["EUVD-2021-1713","GHSA-g4xg-fxmg-vcg5","RUSTSEC-2021-0071","UBUNTU-CVE-2021-3013","openSUSE-SU-2024:11300-1"],"status":"published","title":"OS command injection in ripgrep","description":"ripgrep before 13 on Windows allows attackers to trigger execution of arbitrary programs from the current working directory via the -z/--search-zip or --pre flag.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01934,"percentile":0.80223,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2021-06-11T11:19:37Z","modified":"2026-10-20T10:54:39Z","fixes":[{"ecosystem":"crates.io","package":"ripgrep","fixed_in":["13.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"crates.io","package":"grep-cli","fixed_in":["0.1.6"],"sources":["ghsa","osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ripgrep","fixed_in":["13.0.0-2.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"ripgrep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.0"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"grep-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.6"}]}]},{"source":"osv","ecosystem":"crates.io","package":"ripgrep","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"13.0.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"grep-cli","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.1.6"}]}]},{"source":"osv","ecosystem":"crates.io","package":"grep-cli","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.1.6"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rust-ripgrep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.0-2build1","11.0.2-1","11.0.2-1build1","11.0.2-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rust-ripgrep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.1.1-1","13.0.0-2","13.0.0-2ubuntu0.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ripgrep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.0-2.2"}]}]}],"products":[{"vendor":"ripgrep_project","product":"ripgrep"}],"references":[{"url":"https://github.com/BurntSushi/ripgrep/blob/master/CHANGELOG.md","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/BurntSushi/ripgrep/blob/e48a17e1891e1ea9dd06ba0e48d5fb140ca7c0c4/CHANGELOG.md","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3013","tags":["advisory"]},{"url":"https://github.com/BurntSushi/ripgrep/blob/master/CHANGELOG.md#1300-2021-06-12","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2021-0071.html","tags":["web","advisory"]},{"url":"https://github.com/BurntSushi/ripgrep/issues/1773","tags":["web","report"]},{"url":"https://github.com/advisories/GHSA-g4xg-fxmg-vcg5"},{"url":"https://github.com/BurntSushi/ripgrep","tags":["package"]},{"url":"https://crates.io/crates/grep-cli","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2021-3013","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3013","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3013","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-3013","description":"ripgrep before 13 on Windows allows attackers to trigger execution of arbitrary programs from the current working directory via the -z/--search-zip or --pre flag.","status":"published","published":"2021-06-11T11:19:37Z","modified":"2024-08-03T16:45:50.567Z","updated_at":"2026-11-02T14:33:04.360272Z"}],"euvd":[{"id":"EUVD-2021-1713","description":"ripgrep before 13 on Windows allows attackers to trigger execution of arbitrary programs from the current working directory via the -z/--search-zip or --pre flag.","status":"published","published":"2021-06-11T11:19:37Z","modified":"2024-08-03T16:45:50Z","updated_at":"2026-11-03T03:25:14.091701Z"}],"ghsa":[{"id":"GHSA-g4xg-fxmg-vcg5","title":"OS command injection in ripgrep","description":"ripgrep before 13 on Windows allows attackers to trigger execution of arbitrary programs from the current working directory via the -z/--search-zip or --pre flag.","status":"published","published":"2021-08-05T19:31:55Z","modified":"2023-02-03T05:05:56Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:36:42.703723Z"}],"nvd":[{"id":"CVE-2021-3013","description":"ripgrep before 13 on Windows allows attackers to trigger execution of arbitrary programs from the current working directory via the -z/--search-zip or --pre flag.","status":"published","published":"2021-06-11T12:15:12.163Z","modified":"2026-06-17T04:04:33.78Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:06:54.439974Z"}],"osv":[{"id":"CVE-2021-3013","description":"ripgrep before 13 on Windows allows attackers to trigger execution of arbitrary programs from the current working directory via the -z/--search-zip or --pre flag.","status":"published","published":"2021-06-11T12:15:12.163Z","modified":"2026-10-20T10:54:39.897832599Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:19.483607Z"},{"id":"GHSA-g4xg-fxmg-vcg5","title":"OS command injection in ripgrep","description":"ripgrep before 13 on Windows allows attackers to trigger execution of arbitrary programs from the current working directory via the -z/--search-zip or --pre flag.","status":"published","published":"2021-08-05T19:31:55Z","modified":"2023-11-08T04:05:44.745722Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"RUSTSEC-2021-0071","title":"`grep-cli` may run arbitrary executables on Windows","description":"On Windows in versions of `grep-cli` prior to `0.1.6`, it's possible for some\nof the routines to execute arbitrary executables. In particular, a quirk of\nthe Windows process execution API is that it will automatically consider the\ncurrent directory before other directories when resolving relative binary\nnames. Therefore, if you use `grep-cli` to read decompressed files in an\nuntrusted directory with that directory as the CWD, a malicious actor to could\nput, e.g., a `gz.exe` binary in that directory and `grep-cli` will use the\nmalicious actor's version of `gz.exe` instead of the system's.\n\nThis is also technically possible on Unix as well, but only if the `PATH`\nvariable contains `.`. Conventionally, they do not.\n\nA `DecompressionReader` has been fixed to automatically resolve binary names\nusing `PATH`, instead of relying on the Windows API to do it.\n\nIf you use `grep-cli`'s `CommandReader` with a `std::process::Command` value\non Windows, then it is recommended to either construct the `Command` with an\nabsolute binary name, or use `grep-cli`'s new\n[`resolve_binary`](https://docs.rs/grep-cli/0.1.6/grep_cli/fn.resolve_binary.html)\nhelper function.\n\nTo be clear, `grep-cli 0.1.6` mitigates this issue in two ways:\n\n* A `DecompressionReader` will resolve decompression programs to absolute\npaths automatically using the `PATH` environment variable, instead of relying\non Windows APIs to do it (which would result in the undesirable behavior of\nchecking the CWD for a program first).\n* A new function, `resolve_binary`, was added to help users of this crate\nmitigate this behavior when they need to create their own\n`std::process::Command`. For example,\n[ripgrep uses `grep_cli::resolve_binary`](https://github.com/BurntSushi/ripgrep/blob/7ce66f73cf7e76e9f2557922ac8e650eb02cf4ed/crates/core/search.rs#L119-L122)\non the argument given to its `--pre` flag.\n\nWhile the first mitigation fixes this issue for sensible values of `PATH`\nwhen doing decompression search, the second mitigation is imperfect. The more\nfundamental issue is that `std::process::Command` is itself vulnerable to this.","status":"published","published":"2021-06-12T12:00:00Z","modified":"2023-11-08T04:05:44.745722Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:39.492624Z"},{"id":"UBUNTU-CVE-2021-3013","description":"ripgrep before 13 on Windows allows attackers to trigger execution of arbitrary programs from the current working directory via the -z/--search-zip or --pre flag.","status":"published","published":"2021-06-11T12:15:00Z","modified":"2025-10-24T04:49:10Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:27.332852Z"},{"id":"openSUSE-SU-2024:11300-1","title":"ripgrep-13.0.0-2.2 on GA media","description":"These are all security issues fixed in the ripgrep-13.0.0-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:16:14.009692Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}