CVE-2026-44463 | Zed is a code editor. Prior to 0.229.0, Zed's terminal tool … | CVSS 8.6 HIGH

Description

Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission system can be bypassed by prepending environment variable assignments to allowlisted commands, hijacking program behavior (e.g., PAGER) to execute arbitrary code. This vulnerability is fixed in 0.229.0.

Metadata

CVE ID: CVE-2026-44463
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-05-06 15:49 UTC
Published: 2026-05-28 16:15 UTC
Last updated: 2026-05-29 15:15 UTC
Primary CWE: CWE-184
CWE-184: Incomplete List of Disallowed Inputs
Vendor / Product: zed-industries / zed
Sources: cve.org · NVD

Severity & Metrics

8.6 HIGH CVSS 3.1

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
zed-industries	zed	—	< 0.229.0

Weakness (CWE)

CWE	Source	Description
CWE-184	cna	CWE-184: Incomplete List of Disallowed Inputs
CWE-78	cna	CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSS scores (1)

Score	Severity	Version	Source	Vector
8.6	HIGH	3.1	cna	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References (1)

https://github.com/zed-industries/zed/security/advisories/GHSA-c3g6-c3ff-69cg https://github.com/zed-industries/zed/security/advisories/GHSA-c3g6-c3ff-69cg