Zed
CVE-2025-68433
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft repo with malicious .zed/settings.json
-
DeliveryLure developer to clone project
-
ExploitVictim opens project in Zed
-
ExecutionMCP config auto-loads shell command
-
ImpactArbitrary code executes as IDE user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to open an attacker-controlled project in Zed that contains a crafted .zed/settings.json defining a Model Context Protocol (MCP) server whose command field embeds arbitrary shell commands; in versions prior to 0.218.2-pre this configuration is loaded and executed automatically on project open with the IDE user's privileges. Limiting factors: the malicious settings file must already be present on the local filesystem (AV:L), the victim must open the project (UI:R), and the fixed version's worktree trust mechanism blocks automatic execution - so patched installs or users who manually review ./zed/settings.json before opening untrusted projects are not exposed. |
| Impact | This is a genuine, actionable risk rather than inflated CVSS noise, but its severity hinges on a social-engineering step. The NVD/GitHub CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:R, base 7.3) correctly captures that exploitation is local and requires user interaction - specifically opening a malicious project - and yields full C:H/I:H/A:H because arbitrary shell commands execute with the IDE user's privileges. Publicly available exploit code exists (GitHub Security Advisory GHSA-cv6g-cmxc-vw8j), which raises practical risk, but there is NO CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of widespread active exploitation - treat this as a plausible targeted/supply-chain vector (e.g., a poisoned repository) rather than mass exploitation. One signal to verify: the official vector uses PR:L, yet the attacker needs no authentication to the target host - they only craft a malicious repo - so PR:L appears to conflate the victim's own IDE session with attacker privilege; I assess PR:N (see assessed vector). No EPSS or SSVC data was supplied, so automatability and exploitation-maturity scoring cannot be independently confirmed. |
| Exploit ScenarioDerived | An attacker publishes a repository (or submits a pull request) containing a crafted .zed/settings.json that defines an MCP server whose command embeds arbitrary shell commands. When a developer clones and opens the project in a vulnerable Zed version (prior to 0.218.2-pre), the commands execute automatically with no interaction beyond opening the folder. Public exploit code for this technique is available via the GitHub advisory, lowering the bar for reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Arbitrary code execution in the Zed code editor affects all versions prior to 0.218.2-pre, where Model Context Protocol (MCP) server definitions stored in a project's .zed/settings.json are loaded and executed automatically when the project is opened. An attacker who can deliver a project directory containing a crafted settings.json with a malicious MCP command field can run arbitrary shell commands with the privileges of the user running the IDE, requiring only that the victim open the project (no other interaction). The assessed vector is AV:L/AC:L/PR:N/UI:R with high confidentiality, integrity and availability impact, and publicly available exploit code exists; the risk is genuine and actionable, but exploitation hinges on a social-engineering step to get the victim to open an untrusted project, so patched installs or users who review ./zed/settings.json first are not exposed.
RemediationAI
Upgrade Zed to 0.218.2-pre or a later build; that version fixes the issue by adding a worktree trust mechanism that prevents project-supplied MCP configuration from being executed automatically, and users should confirm their channel receives the equivalent stable release since 0.218.2-pre is a pre-release designation. Until upgraded, treat any project directory obtained from an untrusted source as hostile and manually review ./zed/settings.json (notably any MCP server command entries) before opening it in Zed, since merely opening the project is enough to trigger execution. Additional compensating controls include disabling or avoiding project-local MCP configuration where the IDE allows it, and opening untrusted repositories in a sandboxed or low-privilege environment (container, VM, or restricted OS account) so that any shell command executed by a malicious MCP entry cannot reach the user's real credentials, SSH keys, and source trees; the trade-off is reduced editor functionality and extra setup friction. Simply deleting or not shipping the .zed directory in shared/archived projects also blocks the trigger path. Consult the GitHub advisory (GHSA-cv6g-cmxc-vw8j) and https://zed.dev/blog/secure-by-default for the vendor guidance and exact fixed build.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Zed is an IDE that supports the Model Context Protocol (MCP) to register external tool servers, and it reads MCP configuration from a project-local settings file at .zed/settings.json. Because that file can specify an arbitrary command to launch an MCP server, a hostile configuration turns project-open into command execution on the host. The root cause is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command, i.e., command injection): the MCP command field is passed to the shell without the trust boundary that would normally separate third-party project content from user-controlled execution on the local machine. The affected CPE is cpe:2.3:a:zed:zed:*:*:*:*:*:*:*:*, i.e., all Zed builds before 0.218.2-pre. The upstream fix introduces a worktree trust mechanism so that project-supplied MCP configuration is not trusted and executed by default; the assessed CVSS vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting that the malicious file must already reside on the local filesystem, that no credentials are needed, and that the victim must open the project, with full compromise of the user's session on success.
Know when Zed gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Malicious config is a local file executed on project open (AV:L/UI:R); attacker needs no privileges on the host, only a crafted repo, so PR:N; code runs as the user giving C:H/I:H/A:H.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Zed, a code editor, has an aribtrary code execution vulnerability in versions prior to 0.218.2-pre. The Zed IDE loads Model Context Protocol (MCP) configurations from the settings.json file located within a project’s .zed subdirectory. A malicious MCP configuration can contain arbitrary shell commands that run on the host system with the privileges of the user running the IDE. This can be triggered automatically without any user interaction besides opening the project in the IDE. Version 0.218.2-pre fixes the issue by implementing worktree trust mechanism. As a workaround, users should carefully review the contents of project settings files (./zed/settings.json) before opening new projects in Zed.
Executive ViewAI
Zed code editor versions prior to 0.218.2-pre contain an arbitrary code execution flaw that can run malicious commands with the developer's local privileges when a crafted project is opened. Publicly available exploit code exists and no vendor-released patch has been identified, so development teams using Zed face risks including credential theft, source-code tampering, and downstream supply-chain exposure. Leadership should prioritize locating affected installations and enforcing controls that prevent automatic execution from untrusted project files.
No vendor-released patch identified at time of analysis; interim mitigations include: do not open untrusted or unsolicited projects in Zed; inspect .zed/settings.json for MCP command fields before opening a project; disable or restrict MCP server auto-execution where configurable; run Zed as a non-administrative user; use a VM or container for reviewing untrusted projects; and monitor EDR for Zed spawning shell processes such as bash, zsh, cmd.exe, or powershell.exe.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)NVD
Zed, a code editor, has an extension installer allows tar/gzip downloads. [CVSS 8.8 HIGH]
Zed code editor versions prior to 0.224.4 contain a path traversal vulnerability in ZIP extraction that fails to sanitiz
Arbitrary code execution in the Zed code editor (all versions prior to 0.218.2-pre) lets a project's .zed/settings.json
Zed code editor versions before 0.225.9 fail to properly validate symbolic links in Agent file tools, allowing attackers
Zed Editor versions prior to 0.219.4 fail to display tool invocation parameters during permission prompts or after execu
A directory traversal vulnerability with remote code execution in Prim'X Zed!. Rated critical severity (CVSS 9.8), this
Remote code execution in Zed code editor versions prior to 0.227.1 occurs when a user opens a folder containing a malici
Arbitrary code execution in the Zed code editor (versions prior to 0.229.0) is possible by abusing its terminal tool per
Command injection in Zed code editor versions prior to 0.229.0 allows bypass of the terminal tool's permission allowlist
Remote command execution in Zed code editor versions prior to 0.227.1 occurs when opening SSH or WSL remote terminals be
By default, .ZED containers produced by PRIMX ZED!. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
We are tasked to synthesize data from multiple intelligence sources about CVE-2026-44462 into a comprehensive JSON analy
Exploit-DB