starship

Version	Released
`1.27.0` minor	Oct 17, 2026
`1.26.0` unknown	Jun 28, 2026
`1.25.1` unknown	Apr 30, 2026
`1.25.0` unknown	Apr 18, 2026
`1.24.2` unknown	Dec 30, 2025
`1.24.1` unknown	Nov 16, 2025
`1.24.0` unknown	Oct 25, 2025
`1.23.0` unknown	Apr 27, 2025
`1.22.1` unknown	Jan 11, 2025
`1.22.0` unknown	Jan 11, 2025
`1.21.1` unknown	Oct 18, 2024
`1.21.0` unknown yanked	Oct 17, 2024
`1.20.1` unknown	Jul 27, 2024
`1.19.0` unknown 1 CVE	May 15, 2024
`1.18.2` unknown 1 CVE	Mar 29, 2024
`1.18.1` unknown 1 CVE	Mar 24, 2024
`1.17.1` unknown 1 CVE	Jan 02, 2024
`1.17.0` unknown 1 CVE	Dec 28, 2023
`1.16.0` unknown 1 CVE	Jul 30, 2023
`1.15.0` unknown 1 CVE	Jun 06, 2023
`1.14.2` unknown 1 CVE	Apr 12, 2023
`1.14.1` unknown 1 CVE	Apr 11, 2023
`1.13.1` unknown 1 CVE	Feb 26, 2023
`1.12.0` unknown 1 CVE	Dec 13, 2022
`1.11.0` unknown 1 CVE	Oct 15, 2022
`1.10.3` unknown 1 CVE	Sep 08, 2022
`1.10.2` unknown 1 CVE	Aug 19, 2022
`1.10.1` unknown 1 CVE	Aug 15, 2022
`1.10.0` unknown 1 CVE	Aug 14, 2022
`1.9.1` unknown 1 CVE	Jun 27, 2022
`1.8.0` unknown 1 CVE	Jun 16, 2022
`1.7.1` unknown 1 CVE	May 24, 2022
`1.7.0` unknown 1 CVE	May 24, 2022
`1.6.3` unknown 1 CVE	Apr 26, 2022
`1.6.2` unknown 1 CVE	Apr 15, 2022
`1.5.4` unknown 1 CVE	Mar 24, 2022
`1.4.2` unknown 1 CVE	Mar 10, 2022
`1.4.0` unknown 1 CVE	Mar 09, 2022
`1.3.0` unknown 1 CVE	Feb 07, 2022
`1.2.1` unknown 1 CVE	Jan 15, 2022
`1.2.0` unknown 1 CVE	Jan 14, 2022
`1.1.1` unknown 1 CVE	Dec 21, 2021
`1.1.0` unknown 1 CVE	Dec 21, 2021
`1.0.0` unknown 1 CVE	Nov 09, 2021
`0.58.0` unknown	Sep 21, 2021
`0.57.0` unknown	Aug 26, 2021
`0.56.0` unknown	Jul 13, 2021
`0.55.0` unknown	Jun 20, 2021
`0.54.0` unknown	May 15, 2021
`0.53.0` unknown	May 01, 2021

1.27.0 minor

Oct 17, 2026

1.26.0 unknown

Jun 28, 2026

1.25.1 unknown

Apr 30, 2026

1.25.0 unknown

Apr 18, 2026

1.24.2 unknown

Dec 30, 2025

1.24.1 unknown

Nov 16, 2025

1.24.0 unknown

Oct 25, 2025

1.23.0 unknown

Apr 27, 2025

1.22.1 unknown

Jan 11, 2025

1.22.0 unknown

Jan 11, 2025

1.21.1 unknown

Oct 18, 2024

1.21.0 unknown yanked

Oct 17, 2024

1.20.1 unknown

Jul 27, 2024

1.19.0 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

May 15, 2024

1.18.2 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Mar 29, 2024

1.18.1 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Mar 24, 2024

1.17.1 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Jan 02, 2024

1.17.0 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Dec 28, 2023

1.16.0 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Jul 30, 2023

1.15.0 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Jun 06, 2023

1.14.2 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Apr 12, 2023

1.14.1 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Apr 11, 2023

1.13.1 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Feb 26, 2023

1.12.0 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Dec 13, 2022

1.11.0 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Oct 15, 2022

1.10.3 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Sep 08, 2022

1.10.2 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Aug 19, 2022

1.10.1 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Aug 15, 2022

1.10.0 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Aug 14, 2022

1.9.1 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Jun 27, 2022

1.8.0 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Jun 16, 2022

1.7.1 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

May 24, 2022

1.7.0 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

May 24, 2022

1.6.3 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Apr 26, 2022

1.6.2 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Apr 15, 2022

1.5.4 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Mar 24, 2022

1.4.2 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Mar 10, 2022

1.4.0 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Mar 09, 2022

1.3.0 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Feb 07, 2022

1.2.1 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Jan 15, 2022

1.2.0 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Jan 14, 2022

1.1.1 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Dec 21, 2021

1.1.0 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Dec 21, 2021

1.0.0 unknown

1 CVE

CVE-2024-41815 GHSA-vx24-x4mv-vwr5 RUSTSEC-2024-0446 Jul 26, 2024

Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands

7.4 / 10

High

Local High None None Unchanged High High High

Description

Starship is a cross-shell prompt. Starting in version 1.0.0 and prior to version 1.20.0, undocumented and unpredictable shell expansion and/or quoting rules make it easily to accidentally cause shell injection when using custom commands with starship in bash. Version 1.20.0 fixes the vulnerability.

PoC

Have some custom command which prints out information from a potentially untrusted/unverified source.

[custom.git_commit_name]
command = 'git show -s --format="%<(25,mtrunc)%s"'
style = "italic"
when = true

Impact

This issue only affects users with custom commands, so the scope is limited, and without knowledge of others' commands, it could be hard to successfully target someone.

Fixed in


          1.20.0

References

Updated Dec 22, 2025 · Source: OSV.dev

Nov 09, 2021

0.58.0 unknown

Sep 21, 2021

0.57.0 unknown

Aug 26, 2021

0.56.0 unknown

Jul 13, 2021

0.55.0 unknown

Jun 20, 2021

0.54.0 unknown

May 15, 2021

0.53.0 unknown

May 01, 2021

Activity

Details