The Zed editor’s extension installer processes tar and gzip archives without validating symlinks. A crafted archive can create a symbolic link inside the extension work folder that points outside the allowed path, such as to the root directory. When the installer extracts files through that link, it writes to arbitrary host filesystem locations. This manipulation bypasses the intended sandbox and allows an attacker to place executable files or modify critical system files, effectively enabling code execution on the host system. The weakness is a classic pathname traversal issue, identified as CWE‑61.

All installations of Zed Industries’ Zed code editor that use the extension installation feature and run a version earlier than 0.224.4 are affected. This includes any platform where the editor can unpack user‑supplied extensions. Users of 0.224.4 and newer are not vulnerable.

The vulnerability scores 8.8 on CVSS, indicating a high exploitability and impact. The EPSS score of less than 1% suggests that exploitation activity has been observed at a very low rate so far. It is not listed in the CISA KEV catalog. The attack vector is primarily through a malicious extension download or local file tampering; an attacker who can supply or modify the tar archive passed to the updater could gain write access to arbitrary files, resulting in remote code execution. Because no prerequisite software or elevated privileges are required beyond the ability to install a malicious extension, the risk is moderate to high for users who regularly add third‑party extensions.