What is the CVSS score of CVE-2026-44462?

CVE-2026-44462 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-44462?

Yes, a patch is available for CVE-2026-44462. Update the affected software to the latest version immediately.

Zed CVE-2026-44462

EUVD-2026-32938 MEDIUM

Incomplete List of Disallowed Inputs (CWE-184)

2026-05-28 GitHub_M

RCE Zed

6.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.4 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

May 28, 2026 - 18:02 EUVD

Analysis Generated

May 28, 2026 - 17:26 vuln.today

DescriptionGitHub Advisory

Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission system can be bypassed via bash variable expansion chaining (${var@P}), allowing arbitrary command execution under an allowlisted command prefix. This vulnerability is fixed in 0.229.0.

AnalysisAI

{var@P} prompt-string operator. Zed's terminal tool system enforces command-prefix allowlists to control what commands can be executed; the bypass exploits an incomplete input validation list (CWE-184) to chain expansions that resolve to arbitrary shell commands while appearing to match an approved prefix. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the RCE-tagged nature and CVSS High confidentiality impact make it a meaningful concern for users relying on Zed's agentic terminal tool permissions.

Technical ContextAI

Zed is a GPU-accelerated code editor developed by Zed Industries (CPE: cpe:2.3:a:zed-industries:zed:*:*:*:*:*:*:*:*) that includes an integrated terminal with an AI-accessible tool permission system, allowing allowlisted command prefixes to be invoked programmatically. The root cause is CWE-184 (Incomplete List of Disallowed Inputs): the permission system checks command prefixes against an allowlist but fails to account for bash parameter transformation syntax - specifically the ${var@P} prompt-string expansion operator and similar chaining techniques - which allow the shell to evaluate a string that, before expansion, superficially matches an approved prefix but resolves to an entirely different, attacker-controlled command at execution time. This is a classic shell-expansion allowlist bypass, where the validation layer operates on the pre-expansion string while the shell executes the post-expansion result.

RemediationAI

Upgrade Zed to version 0.229.0 or later, which contains the vendor-confirmed fix for this bypass. The fix is documented in the GitHub Security Advisory at https://github.com/zed-industries/zed/security/advisories/GHSA-rqq3-p6x4-q866. If immediate upgrade is not possible, the primary compensating control is to disable or restrict use of Zed's agentic terminal tool feature entirely, preventing any programmatic invocation of the terminal that would be subject to allowlist evaluation. Users should also audit any existing command-prefix allowlists for entries that could be abused via expansion chaining. Note that restricting the terminal tool may degrade AI-assisted workflows within the editor. No additional workarounds beyond disabling the feature were specified in the advisory.