CVE-2026-44461 Details
Description
Zed is a code editor. Prior to 0.227.1, Zed builds SSH/WSL remote commands as a shell command string that starts with exec env ..., but environment variable keys are inserted without shell quoting or validation. If an attacker can control an environment variable key (for example via project terminal settings), shell expansions in the key (such as $(...)) are evaluated by the remote shell when a terminal is opened. This can lead to arbitrary command execution on the remote host under the victim user's account. This vulnerability is fixed in 0.227.1.
A command injection vulnerability has been identified in Zed code editor versions prior to 0.227.1. The issue arises in the SSH and WSL remote command execution paths, where environment variable keys are inserted into the command string without proper shell quoting or validation. This flaw allows an attacker to control environment variable keys—potentially through project terminal settings—leading to the evaluation of shell expansions in the keys, such as command substitution. As a result, arbitrary commands could be executed on the remote host under the account of the user running the terminal session.
Users can update to Zed version 0.227.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zed-industries/zed/security/advisories/GHSA-63qj-jc2q-7hg5 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/zed-industries/zed/security/advisories/GHSA-63qj-jc2q-7hg5 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| zed zed | < 0.227.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 3, 2026 | Initial Analysis | [email protected] |
| May 28, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | New CVE Received | [email protected] |