EUVD-2026-32936CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
Zed is a code editor. Prior to 0.227.1, Zed builds SSH/WSL remote commands as a shell command string that starts with exec env ..., but environment variable keys are inserted without shell quoting or validation. If an attacker can control an environment variable key (for example via project terminal settings), shell expansions in the key (such as $(...)) are evaluated by the remote shell when a terminal is opened. This can lead to arbitrary command execution on the remote host under the victim user's account. This vulnerability is fixed in 0.227.1.
AnalysisAI
Remote command execution in Zed code editor versions prior to 0.227.1 occurs when opening SSH or WSL remote terminals because environment variable keys are passed into a shell command string without quoting or validation. An attacker who can influence project terminal settings (for example, through a shared or malicious project) can embed shell expansions such as $(...) into env var keys, achieving arbitrary command execution on the remote host as the victim user when they open a terminal. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
24 hours: Audit all Zed installations and document versions in use across development teams. 7 days: Upgrade all systems to Zed 0.227.1 or later, prioritizing developers with active SSH/WSL remote terminal usage. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today