CVE-2026-50187

Name of the Vulnerable Software and Affected Versions Oh My Zsh versions prior to 2026-05-28

Description The dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes the ZSH DOTENV FILE variable to the source command after changing directories into a folder containing a .env file. This allows syntactically valid shell commands within that file to execute with the privileges of the current account. Execution can occur without a prompt if ZSH DOTENV PROMPT is set to false or if the default prompt accepts an empty Enter response.

Recommendations Update to a version released after 2026-05-28.