Zed Industries Zed is vulnerable to arbitrary code execution via malicious LSP configurations, potentially allowing attackers to run shell commands with user privileges.

This vulnerability is a command injection flaw (CWE-77) occurring because the IDE loads LSP configurations from a project local settings.json file. An attacker can execute arbitrary shell commands with the privileges of the user running the IDE if the user opens a compromised project without verifying the settings.

Successful exploitation allows an attacker to execute arbitrary code on the host machine, leading to a full compromise of the user account and potential lateral movement within the network. With a CVSS score of 7.7, this represents a high risk to business operations, as it could facilitate data exfiltration or the installation of persistent malware on developer workstations.

Immediate Action: Update the Zed editor to version 0.218.2-pre or later to implement the new worktree trust mechanism.

Proactive Monitoring: Monitor developer endpoints for unusual shell process spawns originating from the Zed application process.

Compensating Controls: Until the update is applied, users must exercise extreme caution and manually inspect the contents of any ./zed/settings.json file before opening an untrusted project in the Zed editor.

Public Exploit Available: Unknown

The risk posed by this vulnerability is significant for development environments. Security teams should mandate an immediate update to version 0.218.2-pre across all developer workstations. Organizations must also reinforce policies regarding the validation of configuration files in projects obtained from untrusted or external sources.