What is the CVSS score of EUVD-2026-32937?

EUVD-2026-32937 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Zed are affected by EUVD-2026-32937?

Zed code editor versions before 0.227.1 contain a remote code execution vulnerability triggered by opening folders with malicious Git configuration files, bypassing the editor's safety mechanisms for…. A patch is available.

How to fix or mitigate EUVD-2026-32937?

Within 24 hours: Identify and inventory all Zed installations across development teams; notify users to avoid opening untrusted repositories until patched. Within 7 days: Upgrade all Zed instances to version 0.227.1 or later; verify patch deployment through automated tools or manual spot checks. Within 30 days: Audit developer machines and Git repositories accessed during the vulnerable period for unauthorized .git/config modifications; document patch compliance.

Zed EUVD-2026-32937

| CVE-2026-44465 HIGH

OS Command Injection (CWE-78)

2026-05-28 GitHub_M

Command Injection RCE Zed

8.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.6 HIGH

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 28, 2026 - 18:02 EUVD

Analysis Generated

May 28, 2026 - 17:20 vuln.today

DescriptionGitHub Advisory

Zed is a code editor. Prior to 0.227.1, Zed IDE executes arbitrary commands when opening a folder with a malicious .git/config file that abuses the core.fsmonitor Git configuration option. This allows an attacker to achieve Remote Code Execution (RCE) when a victim open a folder in untrusted mode. This vulnerability is fixed in 0.227.1.

AnalysisAI

Remote code execution in Zed code editor versions prior to 0.227.1 occurs when a user opens a folder containing a malicious .git/config file that abuses the core.fsmonitor Git configuration option. The flaw triggers even in untrusted mode, defeating the safety boundary users expect when opening unknown repositories, and no public exploit has been identified at time of analysis though the advisory is published by the vendor.

Technical ContextAI

Zed is a Rust-based collaborative code editor developed by Zed Industries (CPE: cpe:2.3:a:zed-industries:zed). The vulnerability is rooted in CWE-78 (OS Command Injection) and abuses Git's core.fsmonitor option, which lets Git invoke an external file system monitor command to track changed files. When Zed opens a directory and initializes its Git integration, it honors per-repository .git/config values including core.fsmonitor, causing Git (invoked under Zed) to execute the attacker-supplied program. This is a well-known Git misuse class - similar fsmonitor abuse has historically affected other editors that auto-load repository configuration without first vetting it against a trusted scope.

RemediationAI

Vendor-released patch: upgrade Zed to 0.227.1 or later, per the GitHub Security Advisory at https://github.com/zed-industries/zed/security/advisories/GHSA-fj2r-rmw6-h222. Until the upgrade is rolled out, do not open untrusted repositories in Zed; if a folder must be inspected, clone it on a sandboxed host or first remove or audit the .git/config file (specifically any core.fsmonitor, core.sshCommand, or other command-invoking keys) before opening. Restricting Zed to opening only directories from known-trusted sources is the most practical compensating control, with the trade-off that it interrupts normal triage of unknown OSS repositories.