CVE-2026-50187

Published: Ago 18, 2026 Last Modified: Ago 18, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,8
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH_DOTENV_FILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the file to execute with the current account's privileges, including without a prompt when ZSH_DOTENV_PROMPT=false or after the default prompt accepts an empty Enter response. This issue is fixed in versions released after 2026-05-28.

94

Improper Control of Generation of Code ('Code Injection')

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control Integrity Confidentiality Availability Non-Repudiation
Potential Impacts:
Bypass Protection Mechanism Gain Privileges Or Assume Identity Execute Unauthorized Code Or Commands Hide Activities
Applicable Platforms
Languages: Interpreted
Technologies: AI/ML
Likelihood of Exploit: Medium
View CWE Details
https://github.com/ohmyzsh/ohmyzsh/commit/d170d18746bb06db7…
https://github.com/ohmyzsh/ohmyzsh/commit/d170d18746bb06db7b2fc97b67e281597a3fc…
https://github.com/ohmyzsh/ohmyzsh/pull/13778
https://github.com/ohmyzsh/ohmyzsh/pull/13778
https://github.com/ohmyzsh/ohmyzsh/security/advisories/GHSA…
https://github.com/ohmyzsh/ohmyzsh/security/advisories/GHSA-3rgh-p3mg-rjqg