CVE-2026-50187: Oh My Zsh Dotenv Plugin RCE Vulnerability

CVE-2026-50187 Overview

CVE-2026-50187 is a code injection vulnerability [CWE-94] in the Oh My Zsh dotenv plugin. Oh My Zsh is a community-driven framework for managing Zsh shell configuration on Unix-like systems. The dotenv plugin located at plugins/dotenv/dotenv.plugin.zsh passes the ZSH_DOTENV_FILE value to source after a user changes into a directory containing a .env file. Any syntactically valid shell commands inside that file execute with the current account's privileges. Execution occurs silently when ZSH_DOTENV_PROMPT=false, or after the default prompt accepts an empty Enter response. The issue is fixed in versions released after 2026-05-28.

Critical Impact
A user who navigates into a directory containing an attacker-controlled .env file can trigger arbitrary command execution under their own account.

Affected Products

Oh My Zsh releases prior to the fix dated 2026-05-28
dotenv plugin file plugins/dotenv/dotenv.plugin.zsh
Shell environments where the dotenv plugin is enabled in .zshrc

Discovery Timeline

2026-08-18 - CVE-2026-50187 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-50187

Vulnerability Analysis

The dotenv plugin is designed to automatically load environment variables from a .env file when a shell session enters a directory containing one. To perform this loading, the plugin invokes the Zsh source builtin against the path stored in ZSH_DOTENV_FILE. The source builtin does not parse the target as a simple key-value environment file. It evaluates the file as shell script. Any command, function call, or subshell expression written in the .env file therefore executes in the current shell context.

When ZSH_DOTENV_PROMPT=false, sourcing occurs without any user interaction. Under the default configuration, the plugin displays a confirmation prompt, but pressing Enter with no input accepts the action. An attacker who can place a malicious .env file in a directory the target user later visits achieves command execution under that user's account.

Root Cause

The root cause is treating an untrusted file intended for key=value assignments as executable shell input. Using source instead of a constrained parser that only accepts variable assignments allows arbitrary shell syntax to be evaluated. Directory-change triggers combined with a permissive default prompt behavior remove the meaningful user gate on execution.

Attack Vector

Exploitation requires the victim to cd into a directory containing an attacker-supplied .env file. Realistic delivery paths include cloned repositories, extracted archives, shared network mounts, and container volumes. The malicious payload consists of standard shell syntax placed inside the .env file. When the victim enters the directory, the plugin evaluates the file and runs the commands. See the GitHub Security Advisory GHSA-3rgh-p3mg-rjqg and the fix commit d170d18 for the technical mechanics.

Detection Methods for CVE-2026-50187

Indicators of Compromise

Unexpected child processes of zsh spawned immediately after a cd or directory-change event.
Presence of .env files that contain shell control operators such as ;, &&, $( ), backticks, or calls to curl, wget, bash, or python.
Outbound network connections initiated by shell processes shortly after a user opens a new terminal in a project directory.

Detection Strategies

Hunt for .env files across developer endpoints and shared storage, then flag files that contain executable shell constructs rather than plain KEY=value lines.
Monitor process lineage where zsh is the parent and the child is an interpreter or network utility with no interactive tty parent command.
Alert on modifications to .env files in repositories that developers commonly clone.

Monitoring Recommendations

Ingest endpoint process telemetry into a centralized data lake and correlate shell process ancestry with directory-change events.
Track use of source on files under user-writable paths and files fetched from untrusted origins.
Review Oh My Zsh plugin configuration across managed macOS and Linux fleets to identify hosts with dotenv enabled and ZSH_DOTENV_PROMPT=false set.

How to Mitigate CVE-2026-50187

Immediate Actions Required

Update Oh My Zsh to a release published after 2026-05-28 using omz update.
Audit .zshrc files and remove dotenv from the plugins=( ... ) array on systems where it is not required.
Instruct users to avoid cd into untrusted repositories or extracted archives until the update is applied.

Patch Information

The fix landed in the Oh My Zsh repository through Pull Request #13778 and commit d170d18. Deploy any Oh My Zsh version released after 2026-05-28 to remediate the issue on all managed endpoints.

Workarounds

Disable the dotenv plugin by removing it from the plugins array in ~/.zshrc and restarting the shell.
Do not set ZSH_DOTENV_PROMPT=false; keep the confirmation prompt enabled and train users to reject unknown .env files.
Restrict developer workflows to trusted directories, and use container or sandbox environments when inspecting third-party repositories.

bash

# Configuration example: disable the dotenv plugin in ~/.zshrc
# Before
# plugins=(git dotenv docker)

# After
plugins=(git docker)

# Then update Oh My Zsh and reload the shell
omz update
exec zsh