Re: Security issue in Zsh restricted mode (zsh -r) – escape via history built‑ins

[Mikael Magnusson <mikachu@xxxxxxxxx>]

Comment in patch below.

On Fri, Jan 30, 2026 at 8:23 PM Oliver Kiddle <opk@xxxxxxx> wrote:
>
> cyber security wrote:
> > I am reporting a security issue in Zsh restricted mode (`zsh -r`).
>
> The patch below does block this along
> with fc -W or -A when a filename is specified.
>
> diff --git a/Src/Modules/system.c b/Src/Modules/system.c
> index f1c0d7042..644fa7f1a 100644
> --- a/Src/Modules/system.c
> +++ b/Src/Modules/system.c
> @@ -336,6 +336,10 @@ bin_sysopen(char *nam, char **args, Options ops, UNUSED(int func))
>         zwarnnam(nam, "file descriptor not specified");
>         return 1;
>      }
> +    if (write || append) {
> +       zwarnnam(nam, "writing not allowed in restricted mode");
> +       return 1;
> +    }

Is this bit supposed to also have an isset(RESTRICTED)?

>      /* file descriptor, either 0-9 or a variable name */
>      fdvar = OPT_ARG(ops, 'u');
> diff --git a/Src/builtin.c b/Src/builtin.c
> index 49fab93da..b2a2af10d 100644
> --- a/Src/builtin.c
> +++ b/Src/builtin.c
> @@ -1506,12 +1506,20 @@ bin_fc(char *nam, char **argv, Options ops, int func)
>         return 0;
>      }
>      if (OPT_ISSET(ops,'W')) {
> +       if (*argv && isset(RESTRICTED)) {
> +           zwarnnam(nam, "writing not allowed in restricted mode");
> +           return 1;
> +       }
>         /* write history to a file */
>         savehistfile(*argv, 1, OPT_ISSET(ops,'I') ? HFILE_SKIPOLD : 0);
>         unqueue_signals();
>         return 0;
>      }
>      if (OPT_ISSET(ops,'A')) {
> +       if (*argv && isset(RESTRICTED)) {
> +           zwarnnam(nam, "writing not allowed in restricted mode");
> +           return 1;
> +       }
>         /* append history to a file */
>         savehistfile(*argv, 1, HFILE_APPEND |
>                      (OPT_ISSET(ops,'I') ? HFILE_SKIPOLD : 0));
>


-- 
Mikael Magnusson