Executive brief
Oh My Zsh is a popular shell configuration framework used by developers to customize their Zsh environment. The dotenv plugin automatically loads environment variables from .env files when entering a directory, but prior to version 2026-05-28, it failed to safely parse these files, allowing malicious shell commands embedded in a .env file to execute automatically with the user's privileges. An attacker could exploit this by placing a crafted .env file in a shared directory, potentially compromising developer systems or stealing credentials.
Technical details
The vulnerability exists in the dotenv plugin (plugins/dotenv/dotenv.plugin.zsh) which sources .env files without proper validation. When a user changes into a directory containing a .env file, the plugin passes the file contents directly to the shell's source command, allowing syntactically valid shell commands to execute with the current user's privileges. The flaw is exacerbated when ZSH_DOTENV_PROMPT=false or when users accept the default prompt by pressing Enter without review. The root cause is insufficient input sanitization of .env file contents. The vulnerability was patched in commits after 2026-05-28 through safe parsing implementation, file size validation, and explicit user confirmation requirements.
Affected products
- Oh My Zsh Oh My Zsh prior to 2026-05-28
Timeline
- 2026-08-18: disclosed
- 2026-05-28: patched