{"action":"Upgrade zsh to 5.8-1 or later.","affected":[{"fixed":"5.8-1","introduced":"0"}],"component":"zsh","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["5.8-1"],"id":"tcs_01M5NE45T4Q2SYYFQNEDXFT4DN","modified_at":"2026-09-21T07:03:17.096518807Z","published_at":"2020-02-24T14:15:11.667Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2019-20044","https://security-tracker.debian.org/tracker/CVE-2019-20044"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2019-20044#Debian:14/zsh","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2019-20044"}],"summary":"In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by e"}