A Zip Slip bug in Zed’s extension archive extraction allows a malicious extension to write files outside its sandbox by supplying a crafted ZIP archive. This vulnerability is a classic path‑traversal flaw (CWE‑22). When exploited, it could enable the attacker to overwrite critical system files or inject executable code, leading to local privilege escalation or remote code execution if the editor runs with elevated privileges.

Zed code editor from Zed Industries. Versions prior to 0.224.4 are vulnerable; 0.224.4 and later contain the fix.

The CVSS score of 7.4 indicates high severity, while the EPSS score of less than 1% suggests a very low likelihood of immediate exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitability requires an attacker to supply a malicious extension archive, which can be achieved by distributing a forged extension via the marketplace or phishing. No public exploit has been documented, but the weaponized nature of the flaw warrants prompt attention.