It was discovered that zsh, a powerful shell and scripting language,
did not prevent recursive prompt expansion. This would allow an
attacker to execute arbitrary commands into a user's shell, for
instance by tricking a vcs_info user into checking out a git branch
with a specially crafted name.
For the oldstable distribution (buster), this problem has been fixed
in version 5.7.1-1+deb10u1.
For the stable distribution (bullseye), this problem has been fixed in