Zed Industries
Monthly
Command injection in Zed code editor versions prior to 0.229.0 allows bypass of the terminal tool's permission allowlist through bash arithmetic expansion syntax $((...)) nested inside permitted commands like echo. Because Zed is increasingly used with AI agent workflows that execute shell commands on behalf of the user, the bypass effectively neutralizes the safety boundary intended to gate dangerous operations. No public exploit identified at time of analysis, but the GitHub Security Advisory GHSA-c99f-97vf-4h5h provides sufficient detail for a working PoC to be reconstructed.
Arbitrary code execution in the Zed code editor (versions prior to 0.229.0) is possible by abusing its terminal tool permission system, which fails to account for environment-variable prefixes on allowlisted commands. An attacker who can influence what the agent runs (for example via a malicious prompt or repository content) can prepend assignments such as PAGER=/path/to/payload to a permitted command and hijack execution. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Remote code execution in Zed code editor versions prior to 0.227.1 occurs when a user opens a folder containing a malicious .git/config file that abuses the core.fsmonitor Git configuration option. The flaw triggers even in untrusted mode, defeating the safety boundary users expect when opening unknown repositories, and no public exploit has been identified at time of analysis though the advisory is published by the vendor.
Remote command execution in Zed code editor versions prior to 0.227.1 occurs when opening SSH or WSL remote terminals because environment variable keys are passed into a shell command string without quoting or validation. An attacker who can influence project terminal settings (for example, through a shared or malicious project) can embed shell expansions such as $(...) into env var keys, achieving arbitrary command execution on the remote host as the victim user when they open a terminal. No public exploit identified at time of analysis, but the issue is fixed in Zed 0.227.1.
We are tasked to synthesize data from multiple intelligence sources about CVE-2026-44462 into a comprehensive JSON analysis, following strict rules. The provided data includes a description, CVSS vector, EPSS, tags, SSVC, CPE, etc. Need to produce a JSON object with fields: product_name, summary, technical_context, risk_assessment, affected_products, remediation, exploit_scenario, exploitation_conditions, attack_chain, confidence_notes, prevalence, prevalence_basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector. First, parse the input: CVE ID, description, CVSS 6.4 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L, CWE-184 (Incomplete List of Disallowed Inputs), EPSS 0.05% (low), Patch available, reported by GitHub_M, CPE for zed from zed-industries, tags RCE and Zed, SSVC: exploitation poc, automatable no, technical impact total. Affected versions from EUVD: zed < 0.229.0. Reference: GitHub advisory. Now, product_name: "Zed" (the code editor). Must be 1-3 words. So "Zed". Summary: Need to synthesize, not copy description. Start with impact verb and product. "Remote code execution via terminal tool permission bypass affects Zed code editor versions prior to 0.229.0." Need to mention that it's a bypass using bash variable expansion chaining, allows arbitrary command execution under an allowlisted command prefix. Mention if actively exploited? KEV status? The data doesn't mention KEV. Input says "Reported by: GitHub_M" but no KEV tag. So no known active exploitation. SSVC says "exploitation: poc", so POC exists but not known exploited. So: "publically available exploit code exists". EPSS 0.05% so low exploitation probability. So summary: "Remote code execution in Zed editor terminal tool permission system allows command injection via bash variable expansion chaining (${var@P}), bypassing allowlisted prefixes. Affects all versions before 0.229.0. No active exploitation confirmed, but proof-of-concept code is available." Technical_context: Explain u
Command injection in Zed code editor versions prior to 0.229.0 allows bypass of the terminal tool's permission allowlist through bash arithmetic expansion syntax $((...)) nested inside permitted commands like echo. Because Zed is increasingly used with AI agent workflows that execute shell commands on behalf of the user, the bypass effectively neutralizes the safety boundary intended to gate dangerous operations. No public exploit identified at time of analysis, but the GitHub Security Advisory GHSA-c99f-97vf-4h5h provides sufficient detail for a working PoC to be reconstructed.
Arbitrary code execution in the Zed code editor (versions prior to 0.229.0) is possible by abusing its terminal tool permission system, which fails to account for environment-variable prefixes on allowlisted commands. An attacker who can influence what the agent runs (for example via a malicious prompt or repository content) can prepend assignments such as PAGER=/path/to/payload to a permitted command and hijack execution. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Remote code execution in Zed code editor versions prior to 0.227.1 occurs when a user opens a folder containing a malicious .git/config file that abuses the core.fsmonitor Git configuration option. The flaw triggers even in untrusted mode, defeating the safety boundary users expect when opening unknown repositories, and no public exploit has been identified at time of analysis though the advisory is published by the vendor.
Remote command execution in Zed code editor versions prior to 0.227.1 occurs when opening SSH or WSL remote terminals because environment variable keys are passed into a shell command string without quoting or validation. An attacker who can influence project terminal settings (for example, through a shared or malicious project) can embed shell expansions such as $(...) into env var keys, achieving arbitrary command execution on the remote host as the victim user when they open a terminal. No public exploit identified at time of analysis, but the issue is fixed in Zed 0.227.1.
We are tasked to synthesize data from multiple intelligence sources about CVE-2026-44462 into a comprehensive JSON analysis, following strict rules. The provided data includes a description, CVSS vector, EPSS, tags, SSVC, CPE, etc. Need to produce a JSON object with fields: product_name, summary, technical_context, risk_assessment, affected_products, remediation, exploit_scenario, exploitation_conditions, attack_chain, confidence_notes, prevalence, prevalence_basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector. First, parse the input: CVE ID, description, CVSS 6.4 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L, CWE-184 (Incomplete List of Disallowed Inputs), EPSS 0.05% (low), Patch available, reported by GitHub_M, CPE for zed from zed-industries, tags RCE and Zed, SSVC: exploitation poc, automatable no, technical impact total. Affected versions from EUVD: zed < 0.229.0. Reference: GitHub advisory. Now, product_name: "Zed" (the code editor). Must be 1-3 words. So "Zed". Summary: Need to synthesize, not copy description. Start with impact verb and product. "Remote code execution via terminal tool permission bypass affects Zed code editor versions prior to 0.229.0." Need to mention that it's a bypass using bash variable expansion chaining, allows arbitrary command execution under an allowlisted command prefix. Mention if actively exploited? KEV status? The data doesn't mention KEV. Input says "Reported by: GitHub_M" but no KEV tag. So no known active exploitation. SSVC says "exploitation: poc", so POC exists but not known exploited. So: "publically available exploit code exists". EPSS 0.05% so low exploitation probability. So summary: "Remote code execution in Zed editor terminal tool permission system allows command injection via bash variable expansion chaining (${var@P}), bypassing allowlisted prefixes. Affects all versions before 0.229.0. No active exploitation confirmed, but proof-of-concept code is available." Technical_context: Explain u