Zed
Monthly
Command injection in Zed code editor versions prior to 0.229.0 allows bypass of the terminal tool's permission allowlist through bash arithmetic expansion syntax $((...)) nested inside permitted commands like echo. Because Zed is increasingly used with AI agent workflows that execute shell commands on behalf of the user, the bypass effectively neutralizes the safety boundary intended to gate dangerous operations. No public exploit identified at time of analysis, but the GitHub Security Advisory GHSA-c99f-97vf-4h5h provides sufficient detail for a working PoC to be reconstructed.
Arbitrary code execution in the Zed code editor (versions prior to 0.229.0) is possible by abusing its terminal tool permission system, which fails to account for environment-variable prefixes on allowlisted commands. An attacker who can influence what the agent runs (for example via a malicious prompt or repository content) can prepend assignments such as PAGER=/path/to/payload to a permitted command and hijack execution. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
We are tasked to synthesize data from multiple intelligence sources about CVE-2026-44462 into a comprehensive JSON analysis, following strict rules. The provided data includes a description, CVSS vector, EPSS, tags, SSVC, CPE, etc. Need to produce a JSON object with fields: product_name, summary, technical_context, risk_assessment, affected_products, remediation, exploit_scenario, exploitation_conditions, attack_chain, confidence_notes, prevalence, prevalence_basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector. First, parse the input: CVE ID, description, CVSS 6.4 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L, CWE-184 (Incomplete List of Disallowed Inputs), EPSS 0.05% (low), Patch available, reported by GitHub_M, CPE for zed from zed-industries, tags RCE and Zed, SSVC: exploitation poc, automatable no, technical impact total. Affected versions from EUVD: zed < 0.229.0. Reference: GitHub advisory. Now, product_name: "Zed" (the code editor). Must be 1-3 words. So "Zed". Summary: Need to synthesize, not copy description. Start with impact verb and product. "Remote code execution via terminal tool permission bypass affects Zed code editor versions prior to 0.229.0." Need to mention that it's a bypass using bash variable expansion chaining, allows arbitrary command execution under an allowlisted command prefix. Mention if actively exploited? KEV status? The data doesn't mention KEV. Input says "Reported by: GitHub_M" but no KEV tag. So no known active exploitation. SSVC says "exploitation: poc", so POC exists but not known exploited. So: "publically available exploit code exists". EPSS 0.05% so low exploitation probability. So summary: "Remote code execution in Zed editor terminal tool permission system allows command injection via bash variable expansion chaining (${var@P}), bypassing allowlisted prefixes. Affects all versions before 0.229.0. No active exploitation confirmed, but proof-of-concept code is available." Technical_context: Explain u
Remote code execution in Zed code editor versions prior to 0.227.1 occurs when a user opens a folder containing a malicious .git/config file that abuses the core.fsmonitor Git configuration option. The flaw triggers even in untrusted mode, defeating the safety boundary users expect when opening unknown repositories, and no public exploit has been identified at time of analysis though the advisory is published by the vendor.
Remote command execution in Zed code editor versions prior to 0.227.1 occurs when opening SSH or WSL remote terminals because environment variable keys are passed into a shell command string without quoting or validation. An attacker who can influence project terminal settings (for example, through a shared or malicious project) can embed shell expansions such as $(...) into env var keys, achieving arbitrary command execution on the remote host as the victim user when they open a terminal. No public exploit identified at time of analysis, but the issue is fixed in Zed 0.227.1.
Zed, a code editor, has an extension installer allows tar/gzip downloads. [CVSS 8.8 HIGH]
Zed code editor versions before 0.225.9 fail to properly validate symbolic links in Agent file tools, allowing attackers to read and write arbitrary files outside the project directory and bypass workspace boundary protections. This vulnerability can expose sensitive user data to language models and leak private files despite configured exclusions. Public exploit code exists and no patch is currently available.
Zed code editor versions prior to 0.224.4 contain a path traversal vulnerability in ZIP extraction that fails to sanitize malicious filenames, allowing attackers to write files outside the intended sandbox directory through crafted extension archives. Public exploit code exists for this vulnerability. An attacker can exploit this by distributing a malicious extension that, when installed, deposits files in arbitrary locations on the affected system.
Zed Editor versions prior to 0.219.4 fail to display tool invocation parameters during permission prompts or after execution, allowing attackers with high privileges to execute tools with malicious or unintended parameters without user awareness. Public exploit code exists for this vulnerability. The issue is resolved in version 0.219.4, which adds expandable tool call details for transparency.
ZED containers produced by PRIMX ZED!. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
ZED containers produced by PRIMX ZED!. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
By default, .ZED containers produced by PRIMX ZED!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Limited plaintext disclosure exists in PRIMX Zed Entreprise for Windows before 6.1.2240, Zed Entreprise for Windows (ANSSI qualification submission) before 6.1.2150, Zed Entreprise for Mac before. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A directory traversal vulnerability with remote code execution in Prim'X Zed!. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Command injection in Zed code editor versions prior to 0.229.0 allows bypass of the terminal tool's permission allowlist through bash arithmetic expansion syntax $((...)) nested inside permitted commands like echo. Because Zed is increasingly used with AI agent workflows that execute shell commands on behalf of the user, the bypass effectively neutralizes the safety boundary intended to gate dangerous operations. No public exploit identified at time of analysis, but the GitHub Security Advisory GHSA-c99f-97vf-4h5h provides sufficient detail for a working PoC to be reconstructed.
Arbitrary code execution in the Zed code editor (versions prior to 0.229.0) is possible by abusing its terminal tool permission system, which fails to account for environment-variable prefixes on allowlisted commands. An attacker who can influence what the agent runs (for example via a malicious prompt or repository content) can prepend assignments such as PAGER=/path/to/payload to a permitted command and hijack execution. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
We are tasked to synthesize data from multiple intelligence sources about CVE-2026-44462 into a comprehensive JSON analysis, following strict rules. The provided data includes a description, CVSS vector, EPSS, tags, SSVC, CPE, etc. Need to produce a JSON object with fields: product_name, summary, technical_context, risk_assessment, affected_products, remediation, exploit_scenario, exploitation_conditions, attack_chain, confidence_notes, prevalence, prevalence_basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector. First, parse the input: CVE ID, description, CVSS 6.4 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L, CWE-184 (Incomplete List of Disallowed Inputs), EPSS 0.05% (low), Patch available, reported by GitHub_M, CPE for zed from zed-industries, tags RCE and Zed, SSVC: exploitation poc, automatable no, technical impact total. Affected versions from EUVD: zed < 0.229.0. Reference: GitHub advisory. Now, product_name: "Zed" (the code editor). Must be 1-3 words. So "Zed". Summary: Need to synthesize, not copy description. Start with impact verb and product. "Remote code execution via terminal tool permission bypass affects Zed code editor versions prior to 0.229.0." Need to mention that it's a bypass using bash variable expansion chaining, allows arbitrary command execution under an allowlisted command prefix. Mention if actively exploited? KEV status? The data doesn't mention KEV. Input says "Reported by: GitHub_M" but no KEV tag. So no known active exploitation. SSVC says "exploitation: poc", so POC exists but not known exploited. So: "publically available exploit code exists". EPSS 0.05% so low exploitation probability. So summary: "Remote code execution in Zed editor terminal tool permission system allows command injection via bash variable expansion chaining (${var@P}), bypassing allowlisted prefixes. Affects all versions before 0.229.0. No active exploitation confirmed, but proof-of-concept code is available." Technical_context: Explain u
Remote code execution in Zed code editor versions prior to 0.227.1 occurs when a user opens a folder containing a malicious .git/config file that abuses the core.fsmonitor Git configuration option. The flaw triggers even in untrusted mode, defeating the safety boundary users expect when opening unknown repositories, and no public exploit has been identified at time of analysis though the advisory is published by the vendor.
Remote command execution in Zed code editor versions prior to 0.227.1 occurs when opening SSH or WSL remote terminals because environment variable keys are passed into a shell command string without quoting or validation. An attacker who can influence project terminal settings (for example, through a shared or malicious project) can embed shell expansions such as $(...) into env var keys, achieving arbitrary command execution on the remote host as the victim user when they open a terminal. No public exploit identified at time of analysis, but the issue is fixed in Zed 0.227.1.
Zed, a code editor, has an extension installer allows tar/gzip downloads. [CVSS 8.8 HIGH]
Zed code editor versions before 0.225.9 fail to properly validate symbolic links in Agent file tools, allowing attackers to read and write arbitrary files outside the project directory and bypass workspace boundary protections. This vulnerability can expose sensitive user data to language models and leak private files despite configured exclusions. Public exploit code exists and no patch is currently available.
Zed code editor versions prior to 0.224.4 contain a path traversal vulnerability in ZIP extraction that fails to sanitize malicious filenames, allowing attackers to write files outside the intended sandbox directory through crafted extension archives. Public exploit code exists for this vulnerability. An attacker can exploit this by distributing a malicious extension that, when installed, deposits files in arbitrary locations on the affected system.
Zed Editor versions prior to 0.219.4 fail to display tool invocation parameters during permission prompts or after execution, allowing attackers with high privileges to execute tools with malicious or unintended parameters without user awareness. Public exploit code exists for this vulnerability. The issue is resolved in version 0.219.4, which adds expandable tool call details for transparency.
ZED containers produced by PRIMX ZED!. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
ZED containers produced by PRIMX ZED!. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
By default, .ZED containers produced by PRIMX ZED!. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Limited plaintext disclosure exists in PRIMX Zed Entreprise for Windows before 6.1.2240, Zed Entreprise for Windows (ANSSI qualification submission) before 6.1.2150, Zed Entreprise for Mac before. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A directory traversal vulnerability with remote code execution in Prim'X Zed!. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.