CVE-2026-44461
highpriority · track · 0EPSS 0.003 · 17 %ileEUUSEPSS · scored 2026-10-27
Zed is a code editor. Prior to 0.227.1, Zed builds SSH/WSL remote commands as a shell command string that starts with exec env ..., but environment variable keys are inserted without shell quoting or validation. If an attacker can control an environment variable key (for example via project terminal settings), shell expansions in the key (such as $(...)) are evaluated by the remote shell when a terminal is opened. This can lead to arbitrary command execution on the remote host under the victim user's account. This vulnerability is fixed in 0.227.1.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
also known as (2)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (4)
External citations — patches, advisories, analysis.
- https://github.com/zed-industries/zed/security/advisories/GHSA-63qj-jc2q-7hg5cnnvd
- https://zed.dev/downloadPatchcnnvd
- https://github.com/zed-industries/zed/security/advisories/GHSA-63qj-jc2q-7hg5enisa_euvd
- https://github.com/zed-industries/zed/security/advisories/GHSA-63qj-jc2q-7hg5ExploitVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan