Executive brief
Zed is a high-performance code editor that includes an AI-powered terminal tool. A security flaw in the terminal's permission system allows an attacker to bypass command restrictions and execute unauthorized code on a user's machine. This could lead to the theft of sensitive data or the installation of malicious software if a user interacts with a malicious AI prompt or script.
Technical details
A vulnerability in Zed's terminal tool permission system allows for an allowlist bypass via Bash variable expansion chaining (specifically using the ${var@P} operator). The root cause is that Zed's regex-based validation only inspects the initial command token (e.g., 'echo') and fails to account for nested shell expansions that occur during execution. An attacker who can influence AI agent tool calls can craft a payload that executes arbitrary commands on Linux systems, even if those commands are not explicitly permitted. This issue is specific to Linux environments as the default version of Bash on macOS does not support the vulnerable substitution syntax. The vulnerability is fixed in version 0.229.0.
Affected products
- Zed Industries Zed < 0.229.0
Timeline
- 2026-05-08: advisory: GitHub security advisory published
- 2026-05-28: disclosed: NVD publication date