{"id":"CVE-2026-50187","aliases":["EUVD-2026-60954","GHSA-3rgh-p3mg-rjqg"],"status":"published","title":"Oh My Zsh: Arbitrary Code Execution in oh-my-zsh dotenv plugin via malicious .env files","description":"Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH_DOTENV_FILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the file to execute with the current account's privileges, including without a prompt when ZSH_DOTENV_PROMPT=false or after the default prompt accepts an empty Enter response. This issue is fixed in versions released after 2026-05-28.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00539,"percentile":0.45675,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2026-08-18T15:09:51Z","modified":"2026-10-28T02:30:27Z","products":[{"vendor":"ohmyzsh","product":"ohmyzsh"}],"references":[{"url":"https://github.com/ohmyzsh/ohmyzsh/security/advisories/GHSA-3rgh-p3mg-rjqg","tags":["x_refsource_CONFIRM","advisory"]},{"url":"https://github.com/ohmyzsh/ohmyzsh/pull/13778","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/ohmyzsh/ohmyzsh/commit/d170d18746bb06db7b2fc97b67e281597a3fc152","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50187.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50187","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-50187","title":"Oh My Zsh: Arbitrary Code Execution in oh-my-zsh dotenv plugin via malicious .env files","description":"Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH_DOTENV_FILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the file to execute with the current account's privileges, including without a prompt when ZSH_DOTENV_PROMPT=false or after the default prompt accepts an empty Enter response. This issue is fixed in versions released after 2026-05-28.","status":"published","published":"2026-08-18T15:09:51.956Z","modified":"2026-08-18T17:46:49.745Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:20:09.098623Z"}],"euvd":[{"id":"EUVD-2026-60954","description":"Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH_DOTENV_FILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the file to execute with the current account's privileges, including without a prompt when ZSH_DOTENV_PROMPT=false or after the default prompt accepts an empty Enter response. This issue is fixed in versions released after 2026-05-28.","status":"published","published":"2026-08-18T15:09:51Z","modified":"2026-08-18T17:46:49Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:46.405062Z"}],"nvd":[{"id":"CVE-2026-50187","description":"Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH_DOTENV_FILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the file to execute with the current account's privileges, including without a prompt when ZSH_DOTENV_PROMPT=false or after the default prompt accepts an empty Enter response. This issue is fixed in versions released after 2026-05-28.","status":"published","published":"2026-08-18T15:16:54.87Z","modified":"2026-09-18T20:05:53.723Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:12:38.976695Z"}],"osv":[{"id":"CVE-2026-50187","title":"Oh My Zsh: Arbitrary Code Execution in oh-my-zsh dotenv plugin via malicious .env files","description":"Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH_DOTENV_FILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the file to execute with the current account's privileges, including without a prompt when ZSH_DOTENV_PROMPT=false or after the default prompt accepts an empty Enter response. This issue is fixed in versions released after 2026-05-28.","status":"published","published":"2026-08-18T15:09:51.956Z","modified":"2026-10-28T02:30:27.287895839Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:45:07.431113Z"}]}}