PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44466 zed-industries CVE debrief

Zed code editor versions prior to 0.229.0 contain a terminal tool permission bypass vulnerability. The editor's terminal tool permission system, designed to restrict command execution to an allowlist, can be circumvented through bash arithmetic expansion syntax `$((...))`. An attacker can nest arbitrary commands within an otherwise permitted command such as `echo`, achieving command injection despite the allowlist controls. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) indicates a local attack vector with low attack complexity, no privileges required, user interaction needed, and changed scope with high impacts to confidentiality, integrity, and availability. The vulnerability is classified under CWE-78 (OS Command Injection). The vendor released version 0.229.0 to remediate this issue.

Vendor
zed-industries
Product
zed
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations and developers using Zed as their primary code editor, particularly those leveraging AI-assisted features that invoke terminal tools. Security teams in development environments where Zed is deployed should prioritize this patch due to the potential for arbitrary code execution. Users who have configured custom terminal tool allowlists may be at elevated risk if those configurations do not account for shell expansion attacks.

Technical summary

The Zed editor's terminal tool implements a permission system intended to restrict command execution to an allowlist of safe commands. The vulnerability exists because the permission validation fails to properly sanitize or detect bash arithmetic expansion syntax. An attacker can embed malicious commands within `$((...))` constructs inside an allowlisted command like `echo`, causing the nested commands to execute while the outer command passes permission checks. This represents a classic command injection pattern where input validation occurs on the apparent command rather than the effective command after shell interpretation. The local attack vector suggests exploitation requires user interaction with a compromised or malicious project, or social engineering to approve a terminal operation. The high severity stems from the potential for complete system compromise once arbitrary command execution is achieved within the editor's context.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Zed to version 0.229.0 or later to eliminate the permission bypass vulnerability
  • Review terminal tool configurations for any custom allowlists that may still permit dangerous bash expansion patterns
  • Audit system logs for suspicious command execution patterns involving arithmetic expansion syntax in Zed's integrated terminal
  • Consider implementing additional command filtering at the operating system level as defense-in-depth
  • Educate users about the risks of approving terminal tool operations in AI-assisted coding environments

Evidence notes

Vulnerability description and remediation version derived from official CVE record and GitHub Security Advisory. CVSS vector and CWE classification sourced from NVD reference data. Attack mechanism (bash arithmetic expansion bypass) explicitly documented in CVE description.

Official resources

2026-05-28