zed-industries vulnerabilities

CVEs per yearBy the year they were published

1. 20253
2. 20269

Newest CVEs

• CVE-2026-44466

  Zed: Allowlist Bypass via Bash Arithmetic Expansion in Terminal Tool Permissions

  zed-industries · zed

  High8.6
• CVE-2026-44463

  Zed: Allowlist Bypass via Environment Variable Injection in Terminal Tool Permissions

  zed-industries · zed

  High8.6
• CVE-2026-44462

  Zed: Allowlist Bypass via Bash Variable Expansion Chain in Terminal Tool Permissions

  zed-industries · zed

  Medium6.4
• CVE-2026-44465

  Zed: Zed IDE Arbitrary Code Execution via untrusted repository with poisoned .git/config

  zed-industries · zed

  High8.6
• CVE-2026-44461

  Zed: Remote Command Injection via Unquoted Environment Variable Keys (SSH / WSL Remote)

  zed-industries · zed

  High8.6
• CVE-2026-27976

  Zed Extension Sandbox Escape via Tar Symlink Following

  zed-industries · zed

  High8.8
• CVE-2026-27967

  Symlink Escape in Agent File Tools

  zed-industries · zed

  High7.1
• CVE-2026-27800

  Zed has Zip Slip Path Traversal in Extension Archive Extraction

  zed-industries · zed

  High7.4
• CVE-2026-25805

  Zed does not show Parameter Values for MCP Tool Calls. Users cannot detect tool poisoning.

  zed-industries · zed

  Medium6.4
• CVE-2025-68433

  Zed IDE MCP Context Server Configuration Arbitrary Code Execution

  zed-industries · zed

  High7.8