PT-2026-44411 · Zed · Zed

Yueyuel · CVE-2026-44461 · Published 2026-05-28 · Updated 2026-06-03

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zed versions prior to 0.227.1

Description Zed builds SSH/WSL remote commands as a shell command string starting with exec env ..., where environment variable keys are inserted without shell quoting or validation. An attacker who can control an environment variable key, such as through project terminal settings, can trigger shell expansions (e.g., $(...)) that are evaluated by the remote shell when a terminal is opened. This allows for arbitrary command execution on the remote host under the victim user's account.

Recommendations Update to version 0.227.1.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-44461

GHSA-63QJ-JC2Q-7HG5

Affected Products

Zed

References · 9

• 🔥 https://github.com/zed-industries/zed/security/advisories/GHSA-63qj-jc2q-7hg5 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44461.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-44461 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-44461 · Security Note
• https://osv.dev/vulnerability/CVE-2026-44461 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44461 · Security Note
• https://ubuntu.com/security/CVE-2026-44461 · Vendor Advisory
• https://t.me/cveNotify/165749 · Telegram Post
• https://twitter.com/DFIR_Lab/status/2060173598115918051 · Twitter Post