Description
Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission system can be bypassed by prepending environment variable assignments to allowlisted commands, hijacking program behavior (e.g., PAGER) to execute arbitrary code. This vulnerability is fixed in 0.229.0.
Affected products
zed: zed
References1
- github.com/zed-industries/zed/security/advisories/GHSA-c3g6-c3f… ExploitVendor Advisory
Metrics
- CVSS 3.1
-
7.8
HIGH
Score source: NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 0% percentile: 14 · as of 15 November 2026
- CWE
- CWE-78CWE-184
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.