Skip to content
OpenAdvisories

Vendor

ohmyzsh

6 known vulnerabilities.

ohmyzsh at a glance

Last 12 months
1
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 1 vulnerability September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202610
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

ohmyzsh/ohmyzsh 5 ohmyzsh 1
All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • High 8.8
    CVE-2026-50187

    Oh My Zsh: Arbitrary Code Execution in oh-my-zsh dotenv plugin via malicious .env files

    Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH_DOTENV_FILE to source after a directory change into a folder containing a .env file, allowing synta…

    ohmyzsh ohmyzsh
  • High 7.5
    CVE-2021-3769

    OS Command Injection in ohmyzsh/ohmyzsh

    # Vulnerability in `pygmalion`, `pygmalion-virtualenv` and `refined` themes **Description**: these themes use `print -P` on user-supplied strings to print them to the terminal. All of them do that on git information, particularly the branch name, so if the br…

    ohmyzsh ohmyzsh/ohmyzsh
  • High 7.5
    CVE-2021-3727

    OS Command Injection in ohmyzsh/ohmyzsh

    # Vulnerability in `rand-quote` and `hitokoto` plugins **Description**: the `rand-quote` and `hitokoto` fetch quotes from quotationspage.com and hitokoto.cn respectively, do some process on them and then use `print -P` to print them. If these quotes contained…

    ohmyzsh ohmyzsh/ohmyzsh
  • High 7.5
    CVE-2021-3726

    OS Command Injection in ohmyzsh/ohmyzsh

    # Vulnerability in `title` function **Description**: the `title` function defined in `lib/termsupport.zsh` uses `print` to set the terminal title to a user-supplied string. In Oh My Zsh, this function is always used securely, but custom user code could use th…

    ohmyzsh ohmyzsh/ohmyzsh
  • High 7.5
    CVE-2021-3725

    OS Command Injection in ohmyzsh/ohmyzsh

    Vulnerability in dirhistory plugin Description: the widgets that go back and forward in the directory history, triggered by pressing Alt-Left and Alt-Right, use functions that unsafely execute eval on directory names. If you cd into a directory with a careful…

    ohmyzsh ohmyzsh/ohmyzsh
  • High 7.8
    CVE-2021-3934

    OS Command Injection in ohmyzsh/ohmyzsh

    ohmyzsh is vulnerable to Improper Neutralization of Special Elements used in an OS Command

    ohmyzsh ohmyzsh/ohmyzsh