PatchSiren cyber security CVE debrief

CVE-2026-44465 zed-industries CVE debrief

Zed IDE versions prior to 0.227.1 execute arbitrary commands when opening a folder containing a malicious .git/config file that abuses the core.fsmonitor Git configuration option. This vulnerability enables Remote Code Execution (RCE) when a victim opens a folder in untrusted mode. The issue was fixed in Zed version 0.227.1. The vulnerability stems from improper neutralization of special elements used in an OS command (CWE-78), where the editor's handling of Git repository configuration allows injection of arbitrary commands through the fsmonitor hook mechanism.

Vendor: zed-industries
Product: zed
CVSS: HIGH 8.6
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-28
Original CVE updated: 2026-05-28
Advisory published: 2026-05-28
Advisory updated: 2026-05-28

Who should care

Development teams and individual developers using Zed IDE; security teams managing software development environments; organizations with bring-your-own-device or contractor development workflows; anyone opening external or untrusted repositories in Zed IDE

Technical summary

The Zed IDE improperly handles the core.fsmonitor Git configuration option when opening folders. A malicious .git/config file can specify an arbitrary executable as the fsmonitor hook, which Zed executes without adequate validation. This occurs in untrusted mode folder opening, allowing attackers to achieve Remote Code Execution. The vulnerability is classified as CWE-78 (OS Command Injection) with a CVSS 3.1 score of 8.6 (HIGH severity). The attack vector is local (AV:L) with low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R). The scope is changed (S:C) with high impact on confidentiality, integrity, and availability (C:H/I:H/A:H).

Defensive priority

HIGH

Recommended defensive actions

Upgrade Zed IDE to version 0.227.1 or later to remediate this vulnerability
Exercise caution when opening untrusted folders or repositories in Zed IDE, particularly those with unfamiliar .git/config files
Consider reviewing Git configuration files in external repositories before opening them in any IDE
Enable untrusted mode awareness training for development teams using Zed IDE
Audit systems for Zed IDE versions prior to 0.227.1 and prioritize patching on workstations that handle external or untrusted codebases

Evidence notes

Official GitHub Security Advisory GHSA-fj2r-rmw6-h222 confirms the vulnerability and fix version. NVD record published 2026-05-28 with CVSS 3.1 score 8.6 (HIGH).

Official resources

2026-05-28