Zed CVE-2025-68432

Exploitation requires the victim to open, in a vulnerable Zed version (< 0.218.2-pre), a project containing an attacker-controlled .zed/settings.json whose LSP configuration embeds shell commands; code runs only when the user opens a project file that matches an LSP entry, so a corresponding language type/file must be present and the user must not review the settings beforehand. Limiting factors: mandatory user interaction (opening the untrusted project), no remote/network vector, and the fix (worktree trust mechanism) or the documented workaround (manually reviewing .zed/settings.json before opening new projects) neutralizes the condition.

This is a moderate-severity, interaction-dependent code execution flaw rather than an internet-facing emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R, base 7.3 HIGH) correctly captures that exploitation is local and requires the victim to open a malicious project - there is no network attack surface. A public exploit path exists (GitHub Security Advisory GHSA-29cp-2hmh-hcxj is flagged as an exploit reference), so publicly available exploit code exists, but this CVE is NOT in CISA KEV and no EPSS score was supplied, so there is no evidence of active or widespread exploitation. Note a signal tension worth flagging: the official vector uses PR:L, yet the attacker needs no privileges on the victim's host - they only need to seed attacker-controlled content into a repository the victim later opens; the real gating factor is user interaction (UI:R), not privilege. Impact is high across confidentiality, integrity and availability because the payload runs with the full privileges of the user running the IDE. Net: a real but targeted supply-chain/social-engineering style risk (malicious or compromised repositories), prioritized by whether your developers open untrusted projects, not a mass-exploitable remote vulnerability.

An attacker publishes or contributes to a repository containing a crafted .zed/settings.json that defines a Language Server Protocol entry invoking arbitrary shell commands. When a developer clones the project and opens a matching file in Zed (versions before 0.218.2-pre) without reviewing the settings, the configured 'language server' command executes on the host with the user's privileges. Public exploit detail is available via the GitHub Security Advisory, lowering the effort to reproduce.