Re: Security issue in Zsh restricted mode (zsh -r) – escape via history built‑ins

[Mikael Magnusson <mikachu@xxxxxxxxx>]

On Thu, Jan 29, 2026 at 9:27 AM cyber security <cs7778503@xxxxxxxxx> wrote:
>
> Hello Zsh Maintainers,
>
> I am reporting a security issue in Zsh restricted mode (`zsh -r`).
>
> Summary:
> Restricted Zsh (`zsh -r`) can be escaped by abusing the `history -w`
> and `history -a` built-ins. These commands allow a confined user to
> overwrite files in $HOME, such as `.zprofile` or `.zshrc`. On the next
> login, these files are sourced, enabling PATH modification and
> arbitrary command execution outside the restricted environment. This
> undermines the confinement model of restricted shells.
>
> Impact:
> A local user placed in restricted mode can break out of confinement
> and escalate privileges. This issue is similar to the restricted Bash
> (`rbash`) escape disclosed on oss-security (Jan 28, 2026).
>
> Affected Versions:
> All current versions of Zsh supporting restricted mode (`zsh -r`).
>
> Mitigation:
> Administrators should disable or restrict the use of `history -w` and
> `history -a` in restricted environments, ensure $HOME is unwritable,
> and harden startup file permissions. Symlinks into writable
> directories should also be removed.
>
> References:
> - rbash disclosure: https://www.openwall.com/lists/oss-security/2026/01/28/1
>
> I am requesting acknowledgment of this issue and guidance on whether a
> patch or configuration hardening will be provided upstream. I am also
> requesting a CVE identifier for tracking.
>
> Thank you,
> RelunSec
>

Hi, the following doesn't constitute an official reply from the project.

It may be easy to fix this, in which case I don't really see a reason
to not do it, or it might make the code much messier in which case it
might not be worth it. Are you sure about your 'Summary'? Those
commands look like bash commands, not zsh commands. To write and/or
append history to a file in zsh you would use fc -W and fc -A,
'history -a' does not write to a file, and 'history -w' is not a valid
option at all. I would recommend you ensure your report is correct
before you go further, but also:

Consider the following patch from 6 years ago,
https://www.zsh.org/mla/workers/2019/msg00424.html which added this
text:
       A  shell  Restricted  Mode is an outdated way to restrict what
users may do:  modern
       systems have better, safer and more reliable ways to confine
user actions,  such  as
       chroot jails, containers and zones.

       A  restricted  shell  is  very  difficult  to  implement
safely.  The feature may be
       removed in a future version of zsh.

which probably implies that we wouldn't consider this a security issue
in the first place.

-- 
Mikael Magnusson