PT-2026-39599 · Canonical+2 · Zed

Lociko · Published 2026-05-11 · Updated 2026-05-28 · CVE-2026-44463

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zed versions prior to 0.229.0

Description The terminal tool permission system in the Zed code editor can be bypassed by prepending environment variable assignments to allowlisted commands. This allows an attacker to hijack program behavior, such as using the PAGER variable, to execute arbitrary code.

Recommendations Update to version 0.229.0.

Fix

OS Command Injection

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-78

CWE-184

Related Identifiers

CVE-2026-44463

Affected Products

Zed

References · 6

• https://github.com/zed-industries/zed/security/advisories/GHSA-c3g6-c3ff-69cg · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-44463 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-44463 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44463 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-44463 · Security Note
• https://twitter.com/st0pw4r/status/2053741961576661148 · Twitter Post