Executive brief
Zed is a high-performance code editor. A security flaw in its terminal tool permission system allows an attacker to bypass security restrictions by injecting environment variables into approved commands. If an attacker can influence the editor's AI agent or automated tools, they could execute unauthorized commands on the user's computer, potentially leading to full system compromise or data theft.
Technical details
A vulnerability exists in Zed's terminal tool permission system where the regex-based allowlist fails to account for inline environment variable assignments (e.g., VAR=value cmd). By prepending these assignments to an allowlisted command like 'git', an attacker can manipulate environment variables such as PAGER, EDITOR, or GIT_SSH_COMMAND to execute arbitrary external programs. This is particularly exploitable via AI agent tool calls that can be tricked into running malicious payloads. The issue is rooted in improper neutralization of special elements (CWE-78) and an incomplete allowlist (CWE-184). A fix is available in version 0.229.0.
Affected products
- Zed Industries Zed < 0.229.0
Timeline
- 2026-05-08: advisory: GitHub Security Advisory published
- 2026-05-28: disclosed: CVE published to NVD