Vulnerability · Published May 28, 2026 · Assigned by GitHub_M
CVE-2026-44463Zed: Allowlist Bypass via Environment Variable Injection in Terminal Tool Permissions
High 8.6
In plain English
A high-severity OS command injection in zed from zed-industries. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 3.1)8.6High
Exploit odds (30 days)0.2%top 85.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission system can be bypassed by prepending environment variable assignments to allowlisted commands, hijacking program behavior (e.g., PAGER) to execute arbitrary code. This vulnerability is fixed in 0.229.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:25.10 | zed | no fix listed | UBUNTU-CVE-2026-44463 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| zed-industries | zed | < 0.229.0 |
Weakness: CWE-184, CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://github.com/zed-industries/zed/security/advisories/GHSA-c3g6-c3ff-69cg x_refsource_CONFIRM