See how zsh compares to other vendors in security performance
An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program name that is a substring of the intended one.
In subst.c in zsh through 5.4.2, there is a NULL pointer dereference when using ${(PA)...} on an empty array result.
An issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled, potentially leading to an execve call to a program named on the second line.
In zsh before 5.3, an off-by-one error resulted in undersized buffers that were intended to support PATHMAX characters.
A flaw was found in zsh prior 5.3.1. There was no check when copying to the internal xbuf2 for a preliminary test.
References: https://sourceforge.net/p/zsh/code/ci/c7a9cf465dd620ef48d586026944d9bd7a0d5d6d
A flaw was found in zsh prior 5.0.7. There is a buffer overflow for very long fds in >& fd syntax.
References: https://sourceforge.net/p/zsh/code/ci/49a3086bb67575435251c70ee598e2fd406ef055
AMD. A buffer overflow issue was addressed with improved memory handling.
Last updated 24 July 2024
Last updated 25 August 2025
zsh. An authorization issue was addressed with improved state management.
A flaw was found in zsh prior 5.4.2. There is a crash when copying empty hash table with typeset -p.
Resources: https://sourceforge.net/p/zsh/code/ci/c2cc8b0fbefc9868fa83537f5b6d90fc1ec438dd
Last updated 25 August 2025
Util/difflog.pl in zsh 4.3.4 allows local users to overwrite arbitrary files via a symlink attack on temporary files.
zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the exec.c:hashcmd() function. A local attacker could exploit this to cause a denial of service.
zsh through version 5.4.2 is vulnerable to a stack-based buffer overflow in the utils.c:checkmailpath function. A local attacker could exploit this to execute arbitrary code in the context of another user.