EUVD-2026-60954Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AV:N reflects realistic delivery via git repository; UI:R captures required directory change; full shell execution as current user drives C/I/A:H with no scope change.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH_DOTENV_FILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the file to execute with the current account's privileges, including without a prompt when ZSH_DOTENV_PROMPT=false or after the default prompt accepts an empty Enter response. This issue is fixed in versions released after 2026-05-28.
AnalysisAI
Arbitrary shell command execution in Oh My Zsh's dotenv plugin allows any syntactically valid Zsh command embedded in a .env file to run with the victim user's privileges when they cd into a directory containing that file. The plugin unconditionally sourced the .env file as a shell script rather than parsing it as a structured key-value store, meaning malicious git repositories, shared project directories, or downloaded archives could weaponize routine developer directory-navigation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the victim must have Oh My Zsh installed with the `dotenv` plugin explicitly enabled in their `~/.zshrc` `plugins=(...)` list - this is a non-default opt-in plugin absent from fresh installations; (2) the victim must execute `cd` (or any equivalent directory-change command) into a directory containing a `.env` file controlled by the attacker, such as a cloned git repository, an extracted archive, or a mounted network share; and (3) the execution must not be blocked by the prompt - either `ZSH_DOTENV_PROMPT` is set to `false`, or the victim accepts the confirmation prompt by pressing Enter without reviewing the file. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately reflects the full-compromise impact (C:H/I:H/A:H) and low attack complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Oh My Zsh to any commit after 2026-05-28 by running `omz update` or `git -C ~/.oh-my-zsh pull`; the fix is confirmed present in commit d170d18746bb06db7b2fc97b67e281597a3fc152 (https://github.com/ohmyzsh/ohmyzsh/commit/d170d18746bb06db7b2fc97b67e281597a3fc152). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: disable the dotenv plugin by removing it from the plugins configuration in .zshrc, or set ZSH_DOTENV_PROMPT=true to require explicit user confirmation before sourcing any .env file. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today