CVE-2018-0502

Name: CVE-2018-0502
Creator: NVD / NIST
Published: 2018-09-05T08:29:00.23+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 2.49%

Last modified Jun 17, 2026

CVE-2018-0502 is a vulnerability of currently unknown severity. An issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled, potentially leading to an execve call to a program named on the second line.. EPSS estimates a 2.49% chance of exploitation in the next 30 days.

Description

An issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled, potentially leading to an execve call to a program named on the second line.

Metrics

EPSS Probability

2.49%

82.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-20

Affected Software

Vendor	Product	Versions
Canonical	Ubuntu Linux	14.04
Canonical	Ubuntu Linux	16.04
Canonical	Ubuntu Linux	18.04
Zsh	Zsh	< 5.6

References

https://bugs.debian.org/908000Mailing List, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html
https://security.gentoo.org/glsa/201903-02Third Party Advisory
https://sourceforge.net/p/zsh/code/ci/1c4c7b6a4d17294df028322b70c53803a402233dPatch, Third Party Advisory
https://usn.ubuntu.com/3764-1/Third Party Advisory
https://www.zsh.org/mla/zsh-announce/136Mailing List, Vendor Advisory
https://bugs.debian.org/908000Mailing List, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/12/msg00000.html
https://security.gentoo.org/glsa/201903-02Third Party Advisory
https://sourceforge.net/p/zsh/code/ci/1c4c7b6a4d17294df028322b70c53803a402233dPatch, Third Party Advisory
https://usn.ubuntu.com/3764-1/Third Party Advisory
https://www.zsh.org/mla/zsh-announce/136Mailing List, Vendor Advisory

Timeline

Published: Sep 5, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-0502?

An issue was discovered in zsh before 5.6. The beginning of a #! script file was mishandled, potentially leading to an execve call to a program named on the second line.

How severe is CVE-2018-0502?

Severity scoring for CVE-2018-0502 is pending analysis. The EPSS model estimates a 2.49% probability of exploitation in the next 30 days.

How do I fix CVE-2018-0502?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-0502?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST