Privilege escalation in Zsh often hides in plain sight. Many overlook it, thinking it's a Bash problem, or a kernel problem, or someone else's problem. But Zsh's flexibility makes it a sharp blade. Misconfigurations, unsafe environment variables, unquoted expansions, or insecure functions can hand attackers the keys to your system without touching a binary exploit.
Start with the basics. When Zsh inherits environment variables like PATH from a higher-privileged process, every element in that chain can become a threat. If $PATH points to writable locations and Zsh is called with elevated permissions, privilege escalation becomes a matter of placing a malicious binary in the right directory. Add in features like ZDOTDIR pointing to a user-controlled folder, and you open the door to sourcing untrusted configuration files during privileged sessions.
Unsafe function exports compound the risk. A function stored in the environment and executed by a privileged Zsh instance executes with those privileges, not the user’s. This is where advanced attackers thrive—blending in with legitimate shell functions, setting traps that trigger only in rare contexts, and avoiding detection by security tools tuned for more common vectors.