CVE-2026-44463

HIGH CVSS 8.6 View on NVD ↗

Description

Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission system can be bypassed by prepending environment variable assignments to allowlisted commands, hijacking program behavior (e.g., PAGER) to execute arbitrary code. This vulnerability is fixed in 0.229.0.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

https://github.com/zed-industries/zed/security/advisories/GHSA-c3g6-c3ff-69cg

Published: May 28, 2026 17:16 UTC Modified: May 28, 2026 18:55 UTC