CyberRota Analysis
AI-GeneratedThe dotenv plugin in Oh My Zsh is vulnerable to arbitrary command execution due to improper handling of the ZSH_DOTENV_FILE variable, which allows commands in .env files to run with the current user's privileges. This poses a significant security risk, especially in environments where untrusted .env files may be used, as it can lead to unauthorized access or system compromise. Users and organizations utilizing Oh My Zsh with the dotenv plugin should prioritize updating to versions released after May 28, 2026, to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH_DOTENV_FILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the file to execute with the current account's privileges, including without a prompt when ZSH_DOTENV_PROMPT=false or after the default prompt accepts an empty Enter response. This issue is fixed in versions released after 2026-05-28.