Every CVE Search/ Get API key

CVE-2018-13259

An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated,...

9.8 CriticalFix available

An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.72%Up 1.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one.

Record
CVE-2018-13259
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one.

Record
CVE-2018-13259
Updated
2026-11-02
EUVDEUVD-2018-5207 No score

An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one.

Record
EUVD-2018-5207
Updated
2026-11-03
GitHub AdvisoriesGHSA-8vj4-q4ww-8jf3 9.8

An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated,...

An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one.

Record
GHSA-8vj4-q4ww-8jf3
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
OSV 9.8

An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one.

Record
CVE-2018-13259
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2018-13259 9.8

An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one.

Record
DEBIAN-CVE-2018-13259
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 9 moreShow less
OSVRHSA-2019:2017 5.3

Red Hat Security Advisory: zsh security and bug fix update

Record
RHSA-2019:2017
CVSS 3.0
5.3 MediumCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2018-13259 9.8

An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one.

Record
UBUNTU-CVE-2018-13259
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2026-1777051205 No score

zsh: Fix of 3 CVEs

  • CVE-2018-1071: check bounds when copying path in hashcmd()
  • CVE-2018-7549: avoid crash copying empty hash table
  • CVE-2018-13259: fix shebang line truncation in zexecve()
Record
CLSA-2026-1777051205
Updated
2026-11-02
OSVCLSA-2026-1777051545 No score

zsh: Fix of 3 CVEs

  • CVE-2018-1071: check bounds when copying path in hashcmd()
  • CVE-2018-7549: avoid crash copying empty hash table
  • CVE-2018-13259: fix shebang line truncation in zexecve()
Record
CLSA-2026-1777051545
Updated
2026-11-02
OSVopenSUSE-SU-2024:11543-1 No score

zsh-5.8-7.7 on GA media

These are all security issues fixed in the zsh-5.8-7.7 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11543-1
Updated
2026-11-02
OSVSUSE-SU-2018:2686-1 No score

Security update for zsh

This update for zsh to version 5.6 fixes the following security issues:

  • CVE-2018-0502: The beginning of a #! script file was mishandled, potentially leading to an execve call to a program named on the second line (bsc#1107296).
  • CVE-2018-13259: Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one (bsc#1107294).
Record
SUSE-SU-2018:2686-1
Updated
2026-11-02
OSVSUSE-SU-2022:0161-1 No score

Security update for zsh

This update for zsh fixes the following issues:

  • CVE-2018-0502: Fixed execve call vulnerability to program named on the second line when the beginning of a #! script file was mishandled. (bsc#1107296, bsc#1107294)
  • CVE-2018-13259: Fixed execve call vulnerability to program name that is a substring of the intended one. (bsc#1107296, bsc#1107294)
Record
SUSE-SU-2022:0161-1
Updated
2026-11-02
OSVSUSE-SU-2022:14910-1 No score

Security update for zsh

This update for zsh fixes the following issues:

  • CVE-2019-20044: Fixed an insecure dropping of privileges when unsetting the PRIVILEGED option (bsc#1163882).
  • CVE-2018-13259: Fixed an unexpected truncation of long shebang lines (bsc#1107294).
  • CVE-2018-7549: Fixed a crash when an empty hash table (bsc#1082991).
  • CVE-2018-1083: Fixed a stack-based buffer overflow when using tab completion on directories with long names (bsc#1087026).
  • CVE-2018-1071: Fixed a stack-based buffer overflow when executing certain commands (bsc#1084656).
  • CVE-2018-0502: Fixed a mishandling of shebang lines (bsc#1107296).
  • CVE-2017-18206: Fixed a buffer overflow related to symlink processing (bsc#1083002).
  • CVE-2017-18205: Fixed an application crash when using cd with no arguments (bsc#1082998).
  • CVE-2016-10714: Fixed a potential application crash when handling maximum length paths (bsc#1083250).
  • CVE-2014-10072: Fixed a buffer overflow when scanning very long directory paths for symbolic links (bsc#1082975).
  • CVE-2014-10071: Fixed a buffer overflow when redirecting output to a long file descriptor (bsc#1082977).
  • CVE-2014-10070: Fixed a privilege escalation vulnerability via environment variables (bsc#1082885).
Record
SUSE-SU-2022:14910-1
Updated
2026-11-02
OSVUSN-3764-1 No score

zsh vulnerabilities

It was discovered that Zsh incorrectly handled certain scripts. An attacker could possibly use this issue to execute arbitrary code. (CVE-2018-0502, CVE-2018-13259)

Richard Maciel Costa discovered that Zsh incorrectly handled certain scripts. An attacker could possibly use this issue to execute arbitrary code. (CVE-2018-1100)

Record
USN-3764-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
zsh
TuxCare:CentOS:6
From an advisory covering 3 CVEs
 before 4.3.11-11.el6_10.tuxcare.els1
4.3.11-11.el6_10.tuxcare.els1
zsh-html
TuxCare:CentOS:6
From an advisory covering 3 CVEs
 before 4.3.11-11.el6_10.tuxcare.els1
4.3.11-11.el6_10.tuxcare.els1
zsh
TuxCare:OracleLinux:6
From an advisory covering 3 CVEs
 before 4.3.11-11.el6_10.tuxcare.els1
4.3.11-11.el6_10.tuxcare.els1
zsh-html
TuxCare:OracleLinux:6
From an advisory covering 3 CVEs
 before 4.3.11-11.el6_10.tuxcare.els1
4.3.11-11.el6_10.tuxcare.els1
zsh
Debian:12
 before 5.6-1
5.6-1
zsh
Debian:13
 before 5.6-1
5.6-1
zsh
Debian:14
 before 5.6-1
5.6-1
zsh
Debian:9
From an advisory covering 7 CVEs
 before 5.3.1-4+deb9u1, plus listed versions
5.3.1-4
5.3.1-4+deb9u1
zsh
Red Hat:enterprise_linux:7::client
 before 0:5.0.2-33.el7
0:5.0.2-33.el7
zsh-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:5.0.2-33.el7
0:5.0.2-33.el7
Show 33 moreShow less
Affected packages
PackageAffectedFixed
zsh-html
Red Hat:enterprise_linux:7::client
 before 0:5.0.2-33.el7
0:5.0.2-33.el7
zsh
Red Hat:enterprise_linux:7::computenode
 before 0:5.0.2-33.el7
0:5.0.2-33.el7
zsh-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:5.0.2-33.el7
0:5.0.2-33.el7
zsh-html
Red Hat:enterprise_linux:7::computenode
 before 0:5.0.2-33.el7
0:5.0.2-33.el7
zsh
Red Hat:enterprise_linux:7::server
 before 0:5.0.2-33.el7
0:5.0.2-33.el7
zsh-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:5.0.2-33.el7
0:5.0.2-33.el7
zsh-html
Red Hat:enterprise_linux:7::server
 before 0:5.0.2-33.el7
0:5.0.2-33.el7
zsh
Red Hat:enterprise_linux:7::workstation
 before 0:5.0.2-33.el7
0:5.0.2-33.el7
zsh-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:5.0.2-33.el7
0:5.0.2-33.el7
zsh-html
Red Hat:enterprise_linux:7::workstation
 before 0:5.0.2-33.el7
0:5.0.2-33.el7
zsh
SUSE:Linux Enterprise Module for Basesystem 15
From an advisory covering 2 CVEs
 before 5.6-3.6.1
5.6-3.6.1
zsh
SUSE:HPE Helion OpenStack 8
From an advisory covering 2 CVEs
 before 5.0.5-6.12.2
5.0.5-6.12.2
zsh
SUSE:OpenStack Cloud 8
From an advisory covering 2 CVEs
 before 5.0.5-6.12.2
5.0.5-6.12.2
zsh
SUSE:OpenStack Cloud 9
From an advisory covering 2 CVEs
 before 5.0.5-6.12.2
5.0.5-6.12.2
zsh
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 2 CVEs
 before 5.0.5-6.12.2
5.0.5-6.12.2
zsh
SUSE:OpenStack Cloud Crowbar 9
From an advisory covering 2 CVEs
 before 5.0.5-6.12.2
5.0.5-6.12.2
zsh
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 2 CVEs
 before 5.0.5-6.12.2
5.0.5-6.12.2
zsh
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 2 CVEs
 before 5.0.5-6.12.2
5.0.5-6.12.2
zsh
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 2 CVEs
 before 5.0.5-6.12.2
5.0.5-6.12.2
zsh
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 2 CVEs
 before 5.0.5-6.12.2
5.0.5-6.12.2
zsh
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 2 CVEs
 before 5.0.5-6.12.2
5.0.5-6.12.2
zsh
SUSE:Linux Enterprise Server 12 SP4-LTSS
From an advisory covering 2 CVEs
 before 5.0.5-6.12.2
5.0.5-6.12.2
zsh
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 2 CVEs
 before 5.0.5-6.12.2
5.0.5-6.12.2
zsh
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 2 CVEs
 before 5.0.5-6.12.2
5.0.5-6.12.2
zsh
SUSE:Linux Enterprise Point of Sale 11 SP3
From an advisory covering 12 CVEs
 before 4.3.6-67.9.8.1
4.3.6-67.9.8.1
zsh
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 12 CVEs
 before 4.3.6-67.9.8.1
4.3.6-67.9.8.1
zsh
Ubuntu:14.04:LTS
 before 5.0.2-3ubuntu6.3, plus listed versions
5.0.2-3ubuntu65.0.2-3ubuntu6.15.0.2-3ubuntu6.2
5.0.2-3ubuntu6.3
zsh
Ubuntu:16.04:LTS
 before 5.1.1-1ubuntu2.3, plus listed versions
5.1.1-1ubuntu15.1.1-1ubuntu25.1.1-1ubuntu2.15.1.1-1ubuntu2.2
5.1.1-1ubuntu2.3
zsh
Ubuntu:18.04:LTS
 before 5.4.2-3ubuntu3.1, plus listed versions
5.2-5ubuntu15.4.2-3ubuntu15.4.2-3ubuntu25.4.2-3ubuntu3
5.4.2-3ubuntu3.1
zsh
Ubuntu:14.04:LTS
From an advisory covering 3 CVEs
 before 5.0.2-3ubuntu6.3, plus listed versions
5.0.2-3ubuntu65.0.2-3ubuntu6.15.0.2-3ubuntu6.2
5.0.2-3ubuntu6.3
zsh
Ubuntu:16.04:LTS
From an advisory covering 3 CVEs
 before 5.1.1-1ubuntu2.3, plus listed versions
5.1.1-1ubuntu15.1.1-1ubuntu25.1.1-1ubuntu2.15.1.1-1ubuntu2.2
5.1.1-1ubuntu2.3
zsh
Ubuntu:18.04:LTS
From an advisory covering 3 CVEs
 before 5.4.2-3ubuntu3.1, plus listed versions
5.2-5ubuntu15.4.2-3ubuntu15.4.2-3ubuntu25.4.2-3ubuntu3
5.4.2-3ubuntu3.1
zsh
openSUSE:Tumbleweed
From an advisory covering 6 CVEs
 before 5.8-7.7
5.8-7.7

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-13259 is a critical vulnerability (CVSS 9.8) in Zsh, published September 5, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.72%, the 86th percentile. Fixed in zsh 5.6-1.

References

Show 44 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open