CVE-2026-44463

7.8 highEPSS 0.2%

High (7.8) in zed zed. EPSS 0.2% chance of exploitation in the next 30 days.

Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission system can be bypassed by prepending environment variable assignments to allowlisted commands, hijacking program behavior (e.g., PAGER) to execute arbitrary code. This vulnerability is fixed in 0.229.0.

Severity

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 14% of CVEs (scores of 2026-10-31)
CWEs: CWE-78, CWE-184
Published: 2026-05-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

zed:zed

References

https://github.com/zed-industries/zed/security/advisories/GHSA-c3g6-c3ff-69cg

Check your stack JSON