TI-2026-36946 CVE-2026-50187
Oh My Zsh: Arbitrary Code Execution in oh-my-zsh dotenv plugin via malicious .env files
Priority MEDIUM 41
Oh My Zsh is a community-driven framework for managing Zsh configuration.
Vulnerabilities
6 records
TI-2021-02701 CVE-2021-3769 · GHSA-f8r6-c3hp-ccv4
OS Command Injection in ohmyzsh/ohmyzsh
Priority MEDIUM 44
# Vulnerability in `pygmalion`, `pygmalion-virtualenv` and `refined` themes **Description**: these themes use `print -P` on user-supplied strings to print them to the terminal.
TI-2021-02660 CVE-2021-3727 · GHSA-vg23-f593-6r27
OS Command Injection in ohmyzsh/ohmyzsh
Priority MEDIUM 44
# Vulnerability in `rand-quote` and `hitokoto` plugins **Description**: the `rand-quote` and `hitokoto` fetch quotes from quotationspage.com and hitokoto.cn respectively, do some process on them and then use `print -P` t…
TI-2021-02659 CVE-2021-3726 · GHSA-8jcw-2h4x-29pq
OS Command Injection in ohmyzsh/ohmyzsh
Priority MEDIUM 44
# Vulnerability in `title` function **Description**: the `title` function defined in `lib/termsupport.zsh` uses `print` to set the terminal title to a user-supplied string.
TI-2021-02658 CVE-2021-3725 · GHSA-3jcx-v57w-c6rq
OS Command Injection in ohmyzsh/ohmyzsh
Priority MEDIUM 40
Vulnerability in dirhistory plugin Description: the widgets that go back and forward in the directory history, triggered by pressing Alt-Left and Alt-Right, use functions that unsafely execute eval on directory names.
TI-2021-02841 CVE-2021-3934 · GHSA-gv4m-8hpx-hfqf
OS Command Injection in ohmyzsh/ohmyzsh
Priority LOW 34
ohmyzsh is vulnerable to Improper Neutralization of Special Elements used in an OS Command