CVE-2026-50187: Oh My Zsh: Arbitrary Code Execution in oh-my-zsh dotenv plugin via malicious .env files
Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSHDOTENVFILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the file to execute with the current account's privileges, including without a prompt when ZSHDOTENVPROMPT=false or after the default prompt accepts an empty Enter response. This issue is fixed in versions released after 2026-05-28.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
oh-my-zsh/plugins/dotenv/dotenv.plugin.zsh (dotenv plugin)to a version that resolves this vulnerability.Fixed in after 2026-05-28
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users of the Oh My Zsh dotenv plugin are exposed when they change into a directory containing a malicious .env file. The commands run with the privileges of the account running Zsh.
What does an attacker need to exploit it?
An attacker needs to place or induce a user to enter a directory containing a .env file with syntactically valid shell commands. Exploitation requires user interaction in the form of changing into that directory; no existing account privileges are required.
Is a non-default configuration required for unprompted execution?
The default prompt behavior can still lead to execution if the user accepts the prompt with an empty Enter response. Execution occurs without a prompt when ZSH_DOTENV_PROMPT is set to false.
What should be done if patching cannot happen immediately?
Update to an Oh My Zsh version released after 2026-05-28. Until then, avoid entering untrusted directories that may contain .env files and do not disable the dotenv prompt.