CVEvulnerability

CVE-2026-50187

8.8 HIGH Published 2026-08-18 Modified 2026-09-18 Official page ↗
Status
Awaiting Analysis
Published
2026-08-18
Last modified
2026-09-18
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-94

Description

Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH_DOTENV_FILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the file to execute with the current account's privileges, including without a prompt when ZSH_DOTENV_PROMPT=false or after the default prompt accepts an empty Enter response. This issue is fixed in versions released after 2026-05-28.

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References