Vulnerability · Published May 28, 2026 · Assigned by GitHub_M

CVE-2026-44461Zed: Remote Command Injection via Unquoted Environment Variable Keys (SSH / WSL Remote)

High 8.6

In plain English

A high-severity OS command injection in zed from zed-industries. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.3%top 82.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Zed is a code editor. Prior to 0.227.1, Zed builds SSH/WSL remote commands as a shell command string that starts with exec env ..., but environment variable keys are inserted without shell quoting or validation. If an attacker can control an environment variable key (for example via project terminal settings), shell expansions in the key (such as $(...)) are evaluated by the remote shell when a terminal is opened. This can lead to arbitrary command execution on the remote host under the victim user's account. This vulnerability is fixed in 0.227.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:25.10	zed	no fix listed	UBUNTU-CVE-2026-44461

Affected products (as reported)

Vendor	Product	Versions
zed-industries	zed	< 0.227.1

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

https://github.com/zed-industries/zed/security/advisories/GHSA-63qj-jc2q-7hg5 x_refsource_CONFIRM