A critical command injection vulnerability in the Zed code editor allows unauthenticated attackers to execute arbitrary shell commands on the host system with user privileges.

The IDE improperly processes Model Context Protocol (MCP) configurations within the .zed/settings.json file, leading to command injection (CWE-77). This flaw allows arbitrary code execution triggered automatically when a user opens a project containing a malicious configuration file.

The ability to execute arbitrary code on a developer workstation poses a severe risk to organizational security, including the potential for source code theft, credential harvesting, and lateral movement within the corporate network. With a CVSS score of 7.7, this vulnerability represents a high-severity risk to development environments, as it bypasses standard user protections by leveraging the IDE's trust in local project configurations.

Immediate Action: Update the Zed IDE to version 0.218.2-pre or later to implement the new worktree trust mechanism.

Proactive Monitoring: Review file system access logs for unauthorized modifications to .zed/settings.json files within development project directories.

Compensating Controls: As a temporary workaround, users must manually inspect the contents of any .zed/settings.json file in untrusted or newly cloned repositories before opening them in the Zed application.

Public Exploit Available: Unknown

Given the potential for full system compromise, organizations should prioritize updating all instances of the Zed IDE immediately. Developers should be cautioned against opening projects from untrusted sources until the software has been patched to the secure version.