PT-2026-7326 · Zed · Zed

M10X · Published 2026-02-10 · Updated 2026-02-10 · CVE-2026-25805

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zed versions prior to 0.219.4

Description Zed, a multiplayer code editor, does not display the parameters used when invoking a tool, both during the allowance request and after invocation. This lack of visibility could allow the use of unwanted or malicious values without the user’s knowledge. The issue concerns tool call details and the potential for tool poisoning.

Recommendations Update to version 0.219.4 or later to benefit from expandable tool call details.

Exploit

Fix

Weakness Enumeration

CWE-356

Related Identifiers

CVE-2026-25805

GHSA-F2G4-87H6-4PXQ

Affected Products

Zed

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25805.json · Exploit
• https://github.com/zed-industries/zed/security/advisories/GHSA-f2g4-87h6-4pxq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25805 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25805 · Vendor Advisory
• https://t.me/CVEtracker/44314 · Telegram Post