Read the docs
TI-2021-03184 Aliases CVE-2021-4326GHSA-6q8m-42qq-64r7

Imperative Local Command Injection allows Activity Masking

Priority LOW 34CWE-77Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-77.

Summary

A vulnerability in Imperative framework which allows already-privileged local actors to execute arbitrary shell commands via plugin install/update commands, or maliciously formed environment variables. Impacts Zowe CLI.

Why it matters now

EPSS 0.00255 17th percentileScored 2026-11-07
Fix Fixed Zowe (Open Mainframe Project): 1.28.2, 2.5.0@zowe/imperative (npm): 5.7.1, 4.18.10

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
backstageZowe1.16.0 to before 1.28.2; 2.0.0 to before 2.5.01.28.2, 2.5.0Patch availableCNA
—@zowe/imperative (npm)5.0.0 to before 5.7.15.7.1Patch availableGHSA-6q8m-42qq-64r7
—@zowe/imperative (npm)before 4.18.104.18.10Patch availableGHSA-6q8m-42qq-64r7
  • Zowe Vendorbackstage Affected 1.16.0 to before 1.28.2; 2.0.0 to before 2.5.0 Fixed in 1.28.2, 2.5.0 Patch available CNA
  • @zowe/imperative (npm) Vendor— Affected 5.0.0 to before 5.7.1 Fixed in 5.7.1 Patch available GHSA-6q8m-42qq-64r7
  • @zowe/imperative (npm) Vendor— Affected before 4.18.10 Fixed in 4.18.10 Patch available GHSA-6q8m-42qq-64r7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:zowe:*:*:*:*:*:*:*:*1.16.0 to before 1.28.2; 2.0.0 to before 2.5.0Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:zowe:*:*:*:*:*:*:*:* Versions 1.16.0 to before 1.28.2; 2.0.0 to before 2.5.0 Vulnerable ·backstage

Remediation

  • Fix · CNA Zowe (Open Mainframe Project) Fixed in 1.28.2, 2.5.0
  • Fix · GHSA-6q8m-42qq-64r7 @zowe/imperative (npm) Fixed in 5.7.1 Advisory →
  • Fix · GHSA-6q8m-42qq-64r7 @zowe/imperative (npm) Fixed in 4.18.10 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-4326
  2. 2026-10-03 Alias added: GHSA-6q8m-42qq-64r7

References

Advisory 1

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences