PT-2026-39598 · Zed · Zed

Lociko · CVE-2026-44462 · Published 2026-05-11 · Updated 2026-06-03

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zed versions prior to 0.229.0

Description The terminal tool permission system in the Zed code editor can be bypassed using bash variable expansion chaining (${var@P}). This allows for arbitrary command execution when an allowlisted command prefix is used.

Recommendations Update to version 0.229.0.

Exploit

Fix

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-184

Related Identifiers

CVE-2026-44462

GHSA-RQQ3-P6X4-Q866

Affected Products

Zed

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44462.json · Exploit
• https://github.com/zed-industries/zed/security/advisories/GHSA-rqq3-p6x4-q866 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-44462 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-44462 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-44462 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-44462 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44462 · Security Note
• https://t.me/cveNotify/165750 · Telegram Post
• https://twitter.com/st0pw4r/status/2053741961576661148 · Twitter Post