What is the CVSS score of CVE-2026-44463?

CVE-2026-44463 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Zed are affected by CVE-2026-44463?

Zed code editor versions prior to 0.229.0 contain a high-severity arbitrary code execution vulnerability triggered through environment variable injection in the terminal tool permission system.. A patch is available.

How to fix or mitigate CVE-2026-44463?

Within 24 hours: Audit infrastructure to identify all Zed installations and versions in use. Within 7 days: Distribute upgrade to Zed version 0.229.0 or later across all development teams and enforce it on development systems. Within 30 days: Verify upgrade completion, audit terminal tool permissions, and document patching compliance.

Zed CVE-2026-44463

EUVD-2026-32939 HIGH

Incomplete List of Disallowed Inputs (CWE-184)

2026-05-28 GitHub_M

RCE Zed

8.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.6 HIGH

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 28, 2026 - 18:02 EUVD

Analysis Generated

May 28, 2026 - 17:21 vuln.today

DescriptionGitHub Advisory

Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission system can be bypassed by prepending environment variable assignments to allowlisted commands, hijacking program behavior (e.g., PAGER) to execute arbitrary code. This vulnerability is fixed in 0.229.0.

AnalysisAI

Arbitrary code execution in the Zed code editor (versions prior to 0.229.0) is possible by abusing its terminal tool permission system, which fails to account for environment-variable prefixes on allowlisted commands. An attacker who can influence what the agent runs (for example via a malicious prompt or repository content) can prepend assignments such as PAGER=/path/to/payload to a permitted command and hijack execution. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Zed (cpe:2.3:a:zed-industries:zed) is an AI-assisted code editor whose agent can run shell commands through a terminal tool gated by an allowlist permission system. The vulnerability maps to CWE-184 (Incomplete List of Disallowed Inputs): the allowlist matches on the command token but does not strip or validate inline environment-variable assignments that POSIX shells accept as a prefix (e.g., VAR=value cmd ...). Because many Unix utilities consult environment variables to choose helper programs - PAGER for less/git, EDITOR for many CLIs, LD_PRELOAD for dynamic loading, GIT_SSH_COMMAND for git transport - pointing one of these to an attacker-controlled binary or script turns an otherwise-benign allowlisted command into arbitrary code execution under the user's identity.

RemediationAI

Vendor-released patch: upgrade Zed to 0.229.0 or later, which is the version called out as fixed in GHSA-c3g6-c3ff-69cg (https://github.com/zed-industries/zed/security/advisories/GHSA-c3g6-c3ff-69cg). Until upgrade is complete, disable or restrict Zed's agentic terminal tool / auto-approval of commands and require manual review of every proposed shell invocation - accepting the productivity cost of more confirmation prompts. Avoid opening untrusted repositories or pasting untrusted prompts into the agent, and consider running Zed under a least-privileged user account or container so that PAGER/EDITOR/LD_PRELOAD hijacks cannot reach sensitive credentials or SSH keys; the trade-off is reduced access to developer tooling from within the editor.