Zed Editor versions prior to 0.219.4 do not display the parameters supplied to a tool when a user is asked for permission, nor does it display them after the tool is invoked. As a result, a tool could be run with malicious or unintended values and the user would have no opportunity to detect or correct the misuse, which could compromise the integrity of the code base. This weakness is classified as CWE‑356, the unsafe use of information.

The vulnerability affects the Zed code editor developed by zed‑industries. Any installation of Zed before version 0.219.4 is susceptible to this issue; later releases contain an expandable view of tool call details that mitigates the problem.

The CVSS base score of 6.4 indicates moderate severity, while the EPSS score of less than 1 % suggests a very low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require the attacker to convince a user to approve a tool invocation within a collaborative session, or to embed the malicious tool call inside shared code. The user must manually inspect parameters, which is currently not possible due to the missing UI feedback. Low EPSS and the need for user interaction together imply that the real-world risk is limited, but the potential impact remains significant for developers relying on tool integration.