CVE-2026-44463CWE-184CWE-78

Zed: Allowlist Bypass via Environment Variable Injection in Terminal Tool Permissions

High · published May 28, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
12.4
In the wild
Unconfirmed
What it is

Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission system can be bypassed by prepending environment variable assignments to allowlisted commands, hijacking program behavior (e.g., PAGER) to execute arbitrary code. This vulnerability is fixed in 0.229.0.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00225 · 12.4th percentile
Weaknesses
CWE-184 · Incomplete List of Disallowed Inputs; CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-05-28T16:15Z
EPSS history
Timeline
  • 28 MAY 16:15Z
    Zed: Allowlist Bypass via Environment Variable Injection in Terminal Tool Permissions
    cvelistv5