Bug 2517922 (CVE-2026-50187) - CVE-2026-50187 oh-my-zsh: Oh My Zsh: Arbitrary Code Execution via malicious .env files
Summary: CVE-2026-50187 oh-my-zsh: Oh My Zsh: Arbitrary Code Execution via malicious ....
Keywords:
Status: NEW
Alias: CVE-2026-50187
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-18 15:25 UTC by OSIDB Bzimport
Modified: 2026-09-22 18:33 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-18 15:25:55 UTC 
Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH_DOTENV_FILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the file to execute with the current account's privileges, including without a prompt when ZSH_DOTENV_PROMPT=false or after the default prompt accepts an empty Enter response. This issue is fixed in versions released after 2026-05-28.
Note You need to log in before you can comment on or make changes to this bug.