ohmyzsh CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH ohmyzsh CVE published 2026-08-18

CVE-2026-50187

The dotenv plugin in Oh My Zsh allows syntactically valid shell commands in a .env file to execute with the current account's privileges when changing directories into a folder containing a .env file. This issue is fixed in versions released after 2026-05-28. The vulnerability arises from the plugin passing ZSH_DOTENV_FILE to source without proper validation, potentially leading to unauthorized command ex [truncated]