CVE-2026-50187
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
Oh My Zsh, a framework for managing Zsh configuration, has a vulnerability in the dotenv plugin. After changing to a directory containing a .env file, its contents are executed as shell commands with the current user's privileges, even without a prompt when ZSH_DOTENV_PROMPT=false or after default confirmation. The issue is fixed in versions released after 2026-05-28.
Risk Assessment
A malicious .env file in a directory can execute arbitrary commands on the user's account, potentially leading to system compromise or data theft.
Recommendation
Update Oh My Zsh to the latest version released after 2026-05-28 and avoid using .env files from untrusted sources.
Original NVD description (English source)
Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH_DOTENV_FILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the file to execute with the current account's privileges, including without a prompt when ZSH_DOTENV_PROMPT=false or after the default prompt accepts an empty Enter response. This issue is fixed in versions released after 2026-05-28.