Zed CVE-2026-44463

Exploitation requires (1) the victim to be running a Zed version below 0.229.0, (2) Zed's agent / terminal tool feature to be in use with an allowlist of permitted commands, and (3) the victim to approve or auto-approve an agent-proposed command whose argument vector begins with one or more VAR=value environment-variable assignments before an allowlisted binary that consults that variable (PAGER, EDITOR, GIT_SSH_COMMAND, LD_PRELOAD, etc.). The CVSS UI:R flag confirms user interaction is needed, and AV:L confirms the attack executes in the local user context rather than over the network; the attacker's input typically arrives via indirect prompt injection in repository content, chat input, or LLM tool output rather than a direct network request. Headless or non-agent uses of Zed are not exposed.

The CVSS 8.6 score reflects Scope:Changed with full CIA impact, driven by AV:L (local), AC:L, PR:N, and UI:R - exploitation requires the victim to take an action (running or approving an agent command) but no prior authentication to Zed itself. There is no KEV listing and no POC referenced, so this is a credible-but-not-confirmed exploitation risk; EPSS data was not provided. The realistic threat model is indirect prompt injection or malicious repository content steering the Zed agent into requesting a command that, after env-var prefixing, escapes the allowlist - a meaningful concern for developers using AI agent features but not a mass-exploitable internet-facing flaw. Priority should be high for organizations whose engineers run Zed against untrusted code or LLM outputs, lower for closed-environment use.

A developer asks Zed's agent to operate on a repository whose README, issue, or source comments contain a prompt-injection payload instructing the agent to run something like PAGER=/tmp/x.sh git log where git is allowlisted; the env-var prefix slips past the permission check and git's invocation of $PAGER executes the attacker's script with the user's privileges. Variants substitute EDITOR, GIT_SSH_COMMAND, or LD_PRELOAD against other allowlisted binaries. No public exploit identified at time of analysis.