CVE-2021-40084

9.8 CRITICAL

opensysusers through 0.6 does not safely use eval on files in sysusers.d that may contain shell metacharacters

Published: 2021-08-25 · Last updated: 2026-06-17

Severity and scoring

CVSS: 9.8 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-94

Affected products

Vendor	Product
artixlinux	opensysusers

Description

opensysusers through 0.6 does not safely use eval on files in sysusers.d that may contain shell metacharacters. For example, it allows command execution via a crafted GECOS field whereas systemd-sysusers (a program with the same specification) does not do that.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-40084
[Exploit reference]https://bugs.debian.org/992058
[Other]https://github.com/artix-linux/opensysusers/releases
[Exploit reference]https://bugs.debian.org/992058
[Other]https://github.com/artix-linux/opensysusers/releases

Related CVEs

Same CWE

CVE-2026-24155 — NVIDIA NeMo Framework for all platforms contains a code injection vulnerability (7.8 HIGH)
CVE-2026-49774 — Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station allows Remote Code Inclusion (9.9 CRITICAL)
CVE-2026-48017 — DbGate is cross-platform database manager (8.8 HIGH)
CVE-2026-48836 — Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions (10.0 CRITICAL)
CVE-2026-48124 — Cursor is a code editor built for programming with AI