Zed-industries Zed vulnerabilities

• zed Zed: Allowlist Bypass via Bash Arithmetic Expansion in Terminal Tool Permissions CVE-2026-44466 8.6 HighMay 28, 2026
• zed Zed: Allowlist Bypass via Environment Variable Injection in Terminal Tool Permissions CVE-2026-44463 8.6 HighMay 28, 2026
• zed Zed: Allowlist Bypass via Bash Variable Expansion Chain in Terminal Tool Permissions CVE-2026-44462 6.4 MediumMay 28, 2026
• zed Zed: Zed IDE Arbitrary Code Execution via untrusted repository with poisoned .git/config CVE-2026-44465 8.6 HighMay 28, 2026
• zed Zed: Remote Command Injection via Unquoted Environment Variable Keys (SSH / WSL Remote) CVE-2026-44461 8.6 HighMay 28, 2026
• zed Zed Extension Sandbox Escape via Tar Symlink Following CVE-2026-27976 8.8 HighFebruary 25, 2026
• zed Symlink Escape in Agent File Tools CVE-2026-27967 7.1 HighFebruary 25, 2026
• zed Zed has Zip Slip Path Traversal in Extension Archive Extraction CVE-2026-27800 7.4 HighFebruary 25, 2026
• zed Zed does not show Parameter Values for MCP Tool Calls. Users cannot detect tool poisoning. CVE-2026-25805 6.4 MediumFebruary 10, 2026
• zed Zed IDE MCP Context Server Configuration Arbitrary Code Execution CVE-2025-68433 7.8 HighDecember 17, 2025
• zed Zed IDE LSP Binary Configuration Arbitrary Code Execution CVE-2025-68432 7.8 HighDecember 17, 2025
• zed-industries zed Zed AI Agent Remote Code Execution CVE-2025-55012 8.5 HighAugust 11, 2025