quiver

Quiver : A Meta-Tool for Kali Linux Quiver is an organized namespace of shell functions that pre-fill commands in your terminal so that you can ditch your reliance on notes, copying, pasting, editing, copying and pasting again. Quiver helps you remember how to use every tool in your arsenal and...

quiver

Quiver : Kali Linux 的元工具 Quiver 是一个组织化的 shell 函数命名空间，可在终端中预填充命令，让你摆脱对笔记、复制、粘贴、编辑、再复制粘贴的依赖。Quiver 帮助你记住如何使用 arsenal 中的每个工具，并且不会将它们隐藏在难以维护或更新的脚本后面。相反，你可以使用 Quiver 为每种情况构建可组合的即时工作流。 Quiver 并未覆盖所有工具，它是我个人精选的收藏，我仍在不断添加和更新。针对不同类型的目标和 engagements，有太多工具可供选择，所以我只专注于那些维护良好且最新的工具。如果你希望加入自己偏好的工具，请随时在 issues...

qsreplace

qsreplace Accept URLs on stdin, replace all query string values with a user-supplied value, only output each combination of query string parameters once per host and path. Usage Example input file: root@kitploit: ▶ cat urls.txt https://example.com/path?one=1&two=2...

CVE-2025-55616

CVE-2025-55616 Autore: Rana M.Sinan Adil Vulnerabilità trovata in Zsh che porta a RCE tramite History Expression Punti Chiave Per eseguire questo exploit: basta cambiare l'indirizzo IP e il "p system" nell'exploit , perché l'ho provato anche sul mio secondo laptop, e per cambiarlo esegui questo...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: zsh (UTSA-2026-061494)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-061494 advisory. In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argument. This occurs because...

Astra Linux – Vulnerability in zsh

In Zsh before version 5.8, attackers who were able to execute commands could regain privileges lost due to the --no-PRIVILEGED option. Zsh failed to overwrite the saved user ID, so the original privileges could be restored by executing MODULEPATH=/dir/with/module zmodload with a module that calls...

zi

🎯 Roadmap Generally, new features will be introduced as a component to improve performance and compatibility and not to force, but to allow the user decide and choose the features. Let us know what should be improved and maintained with a ⭐ on features you like and use: ⚙️ Plugins 🌀 Annexes 📦...

CVE-2026-50187

Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSHDOTENVFILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the fil...

CVE-2026-50187 Oh My Zsh: Arbitrary Code Execution in oh-my-zsh dotenv plugin via malicious .env files

Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSHDOTENVFILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the fil...

CVE-2026-50187

Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSHDOTENVFILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the fil...

EUVD-2026-60954

Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSHDOTENVFILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the fil...

CVE-2026-50187

The dotenv plugin in plugins/dotenv/dotenv.plugin.zsh calls source on ZSH_DOTENV_FILE after cd into a directory containing a .env file, executing arbitrary shell commands with the user's privileges. Exploitation requires the user to navigate into a directory containing a malicious .env; no in-the...

PT-2026-77142

Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH DOTENV FILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the...

CVE-2026-73412

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDEDGLOB and MAGICEQUALSUBST...

CVE-2026-73412

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDEDGLOB and MAGICEQUALSUBST...

CVE-2026-73412

Shescape (JavaScript) prior to versions 2.1.14 and 3.0.1 is vulnerable on Unix when the shell is Zsh or the default shell is Zsh, affecting the escape and escapeAll functions. The issue is associated with Zsh options EXTENDED_GLOB and MAGIC_SUBST, enabling home-directory expansion or extended glo...

CVE-2026-73412 Shescape: Path disclosure on Unix with Zsh

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDEDGLOB and MAGICEQUALSUBST...

CVE-2026-73412 Shescape: Path disclosure on Unix with Zsh

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDEDGLOB and MAGICEQUALSUBST...

Shescape: Path disclosure on Unix with Zsh

Impact This impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDEDGLOB and MAGICEQUALSUBST exacerbate the problem. In certain case, an attacker can leverage home directory...

GHSA-6V4M-FW66-8R4X Shescape: Path disclosure on Unix with Zsh

Impact This impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDEDGLOB and MAGICEQUALSUBST exacerbate the problem. In certain case, an attacker can leverage home directory...