What is the CVSS score of CVE-2026-44466?

CVE-2026-44466 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Zed are affected by CVE-2026-44466?

Zed code editor (versions prior to 0.229.0) contains a command injection vulnerability allowing attackers to bypass the terminal tool's safety controls intended to restrict dangerous operations.. A patch is available.

How to fix or mitigate CVE-2026-44466?

Within 24 hours: Audit systems running Zed versions prior to 0.229.0, with priority on those integrated with AI agent tools or automated shell execution workflows. Within 7 days: Disable the Zed terminal tool via configuration settings organization-wide, or prohibit Zed for AI automation workflows until patch availability is confirmed. Within 30 days: Establish alerts for Zed security advisories and commit to immediate patching upon vendor release (target version 0.229.0 or later); evaluate alternative code editors for AI-assisted development scenarios.

Zed CVE-2026-44466

EUVD-2026-32940 HIGH

OS Command Injection (CWE-78)

2026-05-28 GitHub_M

Command Injection Zed

8.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.6 HIGH

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 28, 2026 - 18:02 EUVD

Analysis Generated

May 28, 2026 - 17:20 vuln.today

DescriptionGitHub Advisory

Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission system can be bypassed via bash arithmetic expansion $((...)), allowing execution of arbitrary commands nested inside an allowlisted command like echo. This vulnerability is fixed in 0.229.0.

AnalysisAI

Command injection in Zed code editor versions prior to 0.229.0 allows bypass of the terminal tool's permission allowlist through bash arithmetic expansion syntax $((...)) nested inside permitted commands like echo. Because Zed is increasingly used with AI agent workflows that execute shell commands on behalf of the user, the bypass effectively neutralizes the safety boundary intended to gate dangerous operations. No public exploit identified at time of analysis, but the GitHub Security Advisory GHSA-c99f-97vf-4h5h provides sufficient detail for a working PoC to be reconstructed.

Technical ContextAI

Zed (cpe:2.3:a:zed-industries:zed) is a high-performance collaborative code editor developed by Zed Industries that exposes a terminal tool callable by AI agents and extensions, gated by a permission/allowlist system intended to restrict which shell commands may execute without prompting. The root cause maps to CWE-78 (OS Command Injection): the allowlist checks the outer command token (e.g., 'echo') but does not recursively evaluate bash metasyntax embedded in arguments. Specifically, bash's arithmetic expansion construct $((...)) performs shell expansion before the outer command sees its arguments, and bash permits command substitution-like behavior inside arithmetic contexts, so arbitrary commands embedded inside $((...)) execute under the parent shell privileges even though only 'echo' appears on the allowlist.

RemediationAI

Vendor-released patch: upgrade Zed to version 0.229.0 or later, which corrects the terminal tool's argument parsing so that bash arithmetic expansion no longer slips past the allowlist; the fix is documented in GitHub Security Advisory GHSA-c99f-97vf-4h5h (https://github.com/zed-industries/zed/security/advisories/GHSA-c99f-97vf-4h5h). Until the upgrade is applied, users should disable or refuse the AI agent's terminal tool, avoid auto-approving allowlisted commands, and decline to run Zed against untrusted projects, prompts, or MCP servers that can author commands on the user's behalf - the trade-off is loss of agentic terminal automation in trusted workflows. Operating Zed under a least-privilege OS account also limits blast radius if a bypass triggers, at the cost of friction with local tooling that expects the user's normal environment.