PT-2026-22049 · Zed · Zed

Yueyuel · Publicado 2026-02-25 · Atualizado 2026-03-05 · CVE-2026-27967

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Zed versions prior to 0.225.9

Description A symlink escape issue exists in Zed, a code editor, within the Agent file tools (read file, edit file). This allows reading and writing files outside the project directory when the project contains symbolic links pointing to external paths. This bypasses workspace boundaries and privacy protections (file scan exclusions, private files), potentially exposing sensitive user data to the LLM. The issue allows bypassing the intended workspace boundary and privacy protections.

Recommendations Update to version 0.225.9 or later.

Exploit

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2026-27967

GHSA-786M-X2VC-5235

Produtos afetados

Zed

Referências · 8

• 🔥 https://github.com/zed-industries/zed/security/advisories/GHSA-786m-x2vc-5235 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27967.json · Exploit
• https://t.me/CVEtracker/45803 · Publicação no Telegram
• https://twitter.com/cracbot/status/2028787620797681982 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-27967 · Nota de Segurança
• https://twitter.com/CVEnew/status/2027004259988807721 · Publicação no Twitter
• https://t.me/cveNotify/154352 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-27967 · Aviso do Fabricante