CVE-2026-44463

EUVD-2026-32939
Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission system can be bypassed by prepending environment variable assignments to allowlisted commands, hijacking program behavior (e.g., PAGER) to execute arbitrary code. This vulnerability is fixed in 0.229.0.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.6 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 13.81%
Affected Products (NVD)
VendorProductVersion
zedzed
𝑥
< 0.229.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
zed
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
questing
ignored
resolute
not-affected
xenial
not-affected
Common Weakness Enumeration
References
https://github.com/zed-industries/zed/security/advisories/GHSA-c3g6-c3ff-69cg