PT-2026-22050 · Zed · Zed

Jayasuryajsk · Publicado 2026-02-25 · Atualizado 2026-03-05 · CVE-2026-27976

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zed versions prior to 0.224.4

Description The extension installer in Zed allows tar/gzip downloads. Prior to version 0.224.4, the tar extractor uses async tar::Archive::unpack which creates symlinks from the archive without validation. The path guard writeable path from extension performs lexical prefix checks without resolving symlinks. An attacker can ship a tar archive that creates a symlink inside the extension workdir pointing outside, then writes files through the symlink, causing writes to arbitrary host paths. This escapes the extension sandbox and enables code execution.

Recommendations Update to Zed version 0.224.4 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-61

Identificadores relacionados

CVE-2026-27976

GHSA-59P4-3MHM-QM3R

Produtos afetados

Zed

Referências · 9

• 🔥 https://github.com/zed-industries/zed/security/advisories/GHSA-59p4-3mhm-qm3r · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27976.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-27976 · Aviso do Fabricante
• https://twitter.com/CveTodo/status/2026819097908990445 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-27976 · Nota de Segurança
• https://t.me/CVEtracker/45804 · Publicação no Telegram
• https://t.me/cveNotify/154353 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2027004258957111748 · Publicação no Twitter
• https://twitter.com/cracbot/status/2028787622546682152 · Publicação no Twitter