PT-2026-22050 · Zed · Zed

Jayasuryajsk · Published 2026-02-25 · Updated 2026-03-05 · CVE-2026-27976

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zed versions prior to 0.224.4

Description The extension installer in Zed allows tar/gzip downloads. Prior to version 0.224.4, the tar extractor uses async tar::Archive::unpack which creates symlinks from the archive without validation. The path guard writeable path from extension performs lexical prefix checks without resolving symlinks. An attacker can ship a tar archive that creates a symlink inside the extension workdir pointing outside, then writes files through the symlink, causing writes to arbitrary host paths. This escapes the extension sandbox and enables code execution.

Recommendations Update to Zed version 0.224.4 or later.

Exploit

Fix

Weakness Enumeration

CWE-61

Related Identifiers

CVE-2026-27976

GHSA-59P4-3MHM-QM3R

Affected Products

Zed

References · 9

• 🔥 https://github.com/zed-industries/zed/security/advisories/GHSA-59p4-3mhm-qm3r · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27976.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-27976 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27976 · Security Note
• https://twitter.com/CveTodo/status/2026819097908990445 · Twitter Post
• https://t.me/CVEtracker/45804 · Telegram Post
• https://t.me/cveNotify/154353 · Telegram Post
• https://twitter.com/CVEnew/status/2027004258957111748 · Twitter Post
• https://twitter.com/cracbot/status/2028787622546682152 · Twitter Post