What is the CVSS score of CVE-2026-27967?

CVE-2026-27967 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of AI / ML are affected by CVE-2026-27967?

Zed code editor versions before 0.225.9 contain a critical symlink vulnerability allowing attackers to read and modify files outside intended project directories.

Is there a public PoC exploit available for CVE-2026-27967?

Yes, a public proof-of-concept exploit is available for CVE-2026-27967. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-27967?

Within 24 hours: Identify all Zed installations and their versions across the organization; disable Zed usage pending remediation or restrict to sandboxed environments without access to sensitive directories. Within 7 days: Monitor for and remove any symbolic links within active Zed projects that point outside project boundaries; implement file access logging. Within 30 days: Upgrade all Zed instances to version 0.225.9 or later once available; establish policy restricting symbolic link usage in development project structures.

AI / ML CVE-2026-27967

HIGH

Improper Link Resolution Before File Access (CWE-59)

2026-02-26 security-advisories@github.com

Path Traversal AI / ML Zed

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 05, 2026 - 16:10 vuln.today

Public exploit code

CVE Published

Feb 26, 2026 - 00:16 nvd

HIGH 7.1

DescriptionGitHub Advisory

Zed, a code editor, has a symlink escape vulnerability in versions prior to 0.225.9 in Agent file tools (read_file, edit_file). It allows reading and writing files outside the project directory when a project contains symbolic links pointing to external paths. This bypasses the intended workspace boundary and privacy protections (file_scan_exclusions, private_files), potentially leaking sensitive user data to the LLM. Version 0.225.9 fixes the issue.

AnalysisAI

Zed code editor versions before 0.225.9 fail to properly validate symbolic links in Agent file tools, allowing attackers to read and write arbitrary files outside the project directory and bypass workspace boundary protections. This vulnerability can expose sensitive user data to language models and leak private files despite configured exclusions. Public exploit code exists and no patch is currently available.

Technical ContextAI

Classified as CWE-59 (Improper Link Resolution Before File Access). Affects Zed. Zed, a code editor, has a symlink escape vulnerability in versions prior to 0.225.9 in Agent file tools (read_file, edit_file). It allows reading and writing files outside the project directory when a project contains symbolic links pointing to external paths. This bypasses the intended workspace boundary and privacy protections (file_scan_exclusions, private_files), potentially leaking sensitive user data to the LLM. Version 0.225.9 fixes the issue.