Security issue in Zsh restricted mode (zsh -r) – escape via history built‑ins

[cyber security <cs7778503@xxxxxxxxx>]

Hello Zsh Maintainers,

I am reporting a security issue in Zsh restricted mode (`zsh -r`).

Summary:
Restricted Zsh (`zsh -r`) can be escaped by abusing the `history -w`
and `history -a` built-ins. These commands allow a confined user to
overwrite files in $HOME, such as `.zprofile` or `.zshrc`. On the next
login, these files are sourced, enabling PATH modification and
arbitrary command execution outside the restricted environment. This
undermines the confinement model of restricted shells.

Impact:
A local user placed in restricted mode can break out of confinement
and escalate privileges. This issue is similar to the restricted Bash
(`rbash`) escape disclosed on oss-security (Jan 28, 2026).

Affected Versions:
All current versions of Zsh supporting restricted mode (`zsh -r`).

Mitigation:
Administrators should disable or restrict the use of `history -w` and
`history -a` in restricted environments, ensure $HOME is unwritable,
and harden startup file permissions. Symlinks into writable
directories should also be removed.

References:
- rbash disclosure: https://www.openwall.com/lists/oss-security/2026/01/28/1

I am requesting acknowledgment of this issue and guidance on whether a
patch or configuration hardening will be provided upstream. I am also
requesting a CVE identifier for tracking.

Thank you,
RelunSec