Current version of the default shell Zsh is 5.7.1, which contains CVE-2019-20044. A fix for this is released in Zsh version 5.8.
Wondering, is there a plan to push this out? If so, when?
In the meantime, here's a couple of ways around this: https://apple.stackexchange.com/questions/389577/verifying-zsh-version-on-macos-catalina-upon-brew-install
Apple will update Zsh when they are ready. That could be in the remaining point updates to Catalina (unlikely), or with macOS Next when they are ready to release it.
If you really need v5.8, then use a package manager (e.g. homebrew); install Zsh into /usr/local/bin, and place that location first in your PATH.
Apple never releases that information.
Theoretically, they have switched to using the Z Shell as they can keep it updated. Bash uses the GPL v3 license, so it is incompatible with Apple's business model.
When will /bin/zsh be updated?
