This vulnerability allows an attacker to read and write arbitrary files outside the intended project workspace when the project contains symbolic links that point to locations outside the project directory. The flaw lies in the Agent file tools, specifically the read_file and edit_file functions, and is caused by insufficient validation of file paths, which is identified as CWE‑59. The impact includes disclosure of sensitive data to the integrated language model and accidental modification of critical system files, leading to potential data exfiltration and integrity compromise.

Affected by Zed Industries’ Zed code editor. Versions prior to 0.225.9 of the agent file tools are vulnerable. The flaw exists in the read_file and edit_file operations when used inside a project that contains symbolic links to paths outside the workspace.

The CVSS score of 7.1 indicates a high severity. The EPSS score is less than 1 %, suggesting a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack can be carried out by supplying a malicious project containing symlinks that point to external files; no network exploitation or elevated privileges are required, so the attack vector is local through the editor’s processing of a symlinked project.