Description

Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH_DOTENV_FILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the file to execute with the current account's privileges, including without a prompt when ZSH_DOTENV_PROMPT=false or after the default prompt accepts an empty Enter response. This issue is fixed in versions released after 2026-05-28.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-18T15:16:54.870Z",
  "pubdate": "2026-08-18T15:16:54.870Z",
  "executiveSummary": "The vulnerability identified in the Oh My Zsh dotenv plugin constitutes an arbitrary command execution flaw affecting the Zsh configuration framework. Specifically, the vulnerability resides within the dotenv plugin located at plugins/dotenv/dotenv.plugin.zsh, where improper handling of environment variables and untrusted configuration files permits the execution of arbitrary shell commands. When a user navigates into a directory containing a maliciously crafted .env file, the framework processes and sources the file contents directly into the current shell session.\nThe business and operational impact of this vulnerability is severe, as successful exploitation results in local code execution with the privileges of the currently authenticated user account. The attacker capabilities involve weaponizing repository directories or project folders containing .env files to compromise developer workstations upon directory traversal. Exploitation requirements depend on user interaction by navigating to the target directory, combined with the configuration state where ZSH_DOTENV_PROMPT=false or where the default prompt accepts an empty Enter response without explicit user authorization. Risk implications include unauthorized access to sensitive environment variables, persistent system compromise, and lateral movement across developer infrastructure.\nAffected systems comprise all Oh My Zsh installations utilizing the dotenv plugin prior to the fix date of 2026-05-28. Remediation requires updating the framework to versions released after the patch date to ensure proper validation and execution checks are enforced during directory transitions.",
  "technicalDetails": "The root cause of the vulnerability stems from insecure sourcing practices within the vulnerable component plugins/dotenv/dotenv.plugin.zsh. The script evaluates the variable ZSH_DOTENV_FILE and directly passes its contents to the shell source command following a directory change event into any folder containing a local .env file. Because .env files typically store environment configurations, treating them as executable shell scripts without strict syntax validation or sanitization introduces a critical code injection vector.\nThe vulnerable component is explicitly the dotenv plugin, specifically in versions of Oh My Zsh released prior to 2026-05-28. The attack vector is local, requiring the victim to navigate into a directory controlled by the threat actor that contains a malicious .env file. Authentication requirements are non-existent at the application layer, as the execution occurs within the user's interactive shell session. Privilege requirements are limited to standard user privileges, meaning any code executed runs directly under the permissions of the targeted user account. Network exposure is not strictly required, as the vector is file-system and directory-navigation based, although the directory containing the payload could theoretically be cloned from a remote repository.\nThe step-by-step attack flow proceeds as follows: First, a threat actor crafts a malicious .env file containing arbitrary, syntactically valid shell commands disguised as environment variables or embedded directly within the file structure. Second, the threat actor places this file within a target directory or publishes it within a Git repository designed to be cloned and accessed by developers. Third, the victim navigates into the infected directory using a terminal session configured with Oh My Zsh and the dotenv plugin enabled. Fourth, the chpwd hook or equivalent directory-change trigger in plugins/dotenv/dotenv.plugin.zsh detects the .env file. Fifth, depending on the configuration where ZSH_DOTENV_PROMPT=false or where the user inadvertently or automatically accepts the prompt via an empty Enter response, the plugin reads ZSH_DOTENV_FILE and executes the source command on the file. Finally, the embedded shell commands within the .env file execute immediately in the context of the current shell session, granting the attacker the ability to execute payloads, exfiltrate sensitive environment data, or establish persistent access."
}