Executive brief
Zed is a high-performance code editor used by developers to manage and edit software projects. A security flaw allows a malicious actor to execute unauthorized commands on a user's computer if the user opens a specially crafted project folder. This could lead to a full system compromise, data theft, or the installation of malware, even if the user opens the folder in 'untrusted' mode.
Technical details
Zed IDE fails to properly sanitize or restrict Git configuration options when opening a repository, even in untrusted mode. Specifically, the editor invokes Git operations that respect the 'core.fsmonitor' setting within a local .git/config file. This setting allows for the execution of an arbitrary shell command to track file changes. An attacker can distribute a poisoned repository that, when opened in Zed, executes arbitrary code with the privileges of the user. This vulnerability is classified as OS Command Injection (CWE-78) and is resolved in version 0.227.1.
Affected products
- Zed Industries Zed IDE < 0.227.1
Timeline
- 2026-05-08: advisory: GitHub advisory published by Zed Industries
- 2026-05-28: disclosed: CVE-2026-44465 published to NVD