CVE-2026-50187
Received Received - Intake

Command Injection in Oh My Zsh Dotenv Plugin

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH_DOTENV_FILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the file to execute with the current account's privileges, including without a prompt when ZSH_DOTENV_PROMPT=false or after the default prompt accepts an empty Enter response. This issue is fixed in versions released after 2026-05-28.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-50187
EUVD
EUVD-2026-60954

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
oh_my_zsh dotenv_plugin to 2026-05-28 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in Oh My Zsh's dotenv plugin allows arbitrary code execution when a user navigates into a directory containing a malicious .env file. The plugin uses the source command to execute the file without proper validation, triggered by a chpwd hook on every cd command. This can lead to full system compromise with the user's privileges.

Detection Guidance

Check Oh My Zsh version with 'echo $ZSH_VERSION'. If using dotenv plugin, verify it's updated after 2026-05-28. Inspect .env files in directories for command substitution like $(...) or backticks. Review shell history for unexpected commands executed during directory changes.

Impact Analysis

An attacker could embed a malicious .env file in a repository or project. When you cd into that directory, the plugin executes the file, running arbitrary commands on your system with your user privileges. This could allow the attacker to steal data, install malware, or take control of your system.

Mitigation Strategies

Update Oh My Zsh to the latest version released after 2026-05-28. Remove or review .env files in project directories. Set ZSH_DOTENV_PROMPT=true to enforce confirmation prompts. Avoid using source to load .env files; use the updated parser instead.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50187. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart