High · published December 18, 2025
⚡ Zed users, beware! A sneaky exploit in your code editor means that opening a project could run malicious commands on your machine! Think of it like a chef receiving a recipe that mixes ingredients without checking the source; one wrong entry could lead to a disaster in the kitchen. In this case, the settings.json file is your recipe, and a malicious entry can cook up trouble on your system! An attacker could craft a project settings file that executes arbitrary commands with the same privileges as the user running Zed. This means they might access sensitive data, modify files, or even compromise your entire system if you open a tainted project without reviewing the configurations first!
Think of it like a chef receiving a recipe that mixes ingredients without checking the source; one wrong entry could lead to a disaster in the kitchen. In this case, the settings.json file is your recipe, and a malicious entry can cook up trouble on your system! This vulnerability arises from the way Zed loads Language Server Protocol (LSP) configurations from the `settings.json` file in a project’s `.zed` subdirectory, allowing for arbitrary code execution if such configurations contain malicious code.
An attacker could craft a project settings file that executes arbitrary commands with the same privileges as the user running Zed. This means they might access sensitive data, modify files, or even compromise your entire system if you open a tainted project without reviewing the configurations first! Upgrade to version 0.218.2-pre immediately to secure your environment! Until then, be vigilant—always review the contents of project settings files (`./zed/settings.json`) before opening new projects. Your caution can save you from a world of hurt. You've got this! Stay informed and vigilant, and you'll keep your coding environment safe and sound! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| zed/zed | < 0.218.2 | 0.218.2 |