Back to feed
EUVD-2026-60954 · Published Aug 18, 2026
Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH_DOTENV_FILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the file to execute with the current account's privileges, including without a prompt when ZSH_DOTENV_PROMPT=false or after the default prompt accepts an empty Enter response. This issue is fixed in versions released after 2026-05-28.
Weaknesses
CWE-94
CVSS scores
- v3.18.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access Stealth
References
Potentially impacted assets
See if this affects your attack surface
