Advisories · Technology
zed.
Every CVE that names zed among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.6 High
Zed: Allowlist Bypass via Bash Arithmetic Expansion in Terminal Tool Permissions
- zed
- Command injection
- CVSS 8.6 High
Zed: Allowlist Bypass via Environment Variable Injection in Terminal Tool Permissions
- zed
- Command injection
- CWE-184
- CVSS 6.4 Medium
Zed: Allowlist Bypass via Bash Variable Expansion Chain in Terminal Tool Permissions
- zed
- CWE-184
- CVSS 8.6 High
Zed: Zed IDE Arbitrary Code Execution via untrusted repository with poisoned .git/config
- zed
- Command injection
- CVSS 8.6 High
Zed: Remote Command Injection via Unquoted Environment Variable Keys (SSH / WSL Remote)
- zed
- Command injection
- CVSS 8.8 High
Zed Extension Sandbox Escape via Tar Symlink Following
- zed
- CWE-61
- CVSS 7.1 High
Symlink Escape in Agent File Tools
- zed
- Path traversal
- CVSS 7.4 High
Zed has Zip Slip Path Traversal in Extension Archive Extraction
- zed
- Path traversal
- CVSS 6.4 Medium
Zed does not show Parameter Values for MCP Tool Calls. Users cannot detect tool poisoning.
- zed
- CWE-356
- CVSS 7.8 High
Zed IDE MCP Context Server Configuration Arbitrary Code Execution
- zed
- Command injection
- CVSS 7.8 High
Zed IDE LSP Binary Configuration Arbitrary Code Execution
- zed
- Command injection
- CVSS 8.5 High
Zed AI Agent Remote Code Execution
- zed
- Broken access control
- Authentication bypass