A path traversal vulnerability in Zed version 0.224.4 and earlier allows for arbitrary file writes, posing a significant risk to system integrity.

The extract_zip() function in crates/util/src/archive.rs fails to sanitize ZIP entry filenames, enabling unauthenticated attackers to perform path traversal using sequences like ../ to overwrite arbitrary files on the host system.

The ability to write files outside of the designated sandbox directory could lead to full compromise of the user account running the Zed editor. By overwriting critical configuration files or placing malicious executables in startup directories, an attacker could achieve persistent unauthorized access or escalate privileges, justifying the high CVSS score of 7.4.

Immediate Action: Update the Zed code editor to version 0.224.4 or later to apply the necessary path validation fixes in the extraction logic.

Proactive Monitoring: Review file system integrity logs for unexpected file modifications or creation events originating from the Zed process or its extension installation directory.

Compensating Controls: Exercise caution when installing third-party extensions from untrusted sources, as the vulnerability is triggered during the extraction of extension archives.

Public Exploit Available: Unknown.

Given the potential for arbitrary file write operations, this vulnerability represents a significant security risk to developer workstations. Organizations should prioritize updating all instances of the Zed editor to version 0.224.4 immediately to remediate the flaw and prevent potential code execution or system compromise.