In Zed 0.226.x and earlier, the editor constructs SSH and WSL remote shell commands by prepending "exec env ..." to a string that includes environment variable keys unquoted and unvalidated. When an attacker can supply a key containing shell expansion syntax—such as $(command)—that syntax is interpreted by the remote shell, allowing the attacker to run arbitrary commands as the victim user. This flaw is a classic example of CWE‑78, the use of unsafe input in an operating system command execution context.

Zed Industries’ Zed code editor is affected, specifically all releases older than 0.227.1. The vulnerability exists for all platforms that support SSH or WSL remote terminal sessions.

The vulnerability carries a CVSS base score of 8.6, indicating a high severity. The EPSS score is not publicly available, but the nature of the flaw—remote command execution via a locally controllable environment variable—suggests a high likelihood of exploitation if the environment variable can be influenced. The attack vector is inferred to be through project terminal settings or similar configuration interfaces that allow an attacker to set environment variable names; the attack requires network access to the remote host via SSH/WSL and local control over Zed’s configuration. The vulnerability is not currently listed in CISA’s KEV catalog, but the high impact warrants pre-emptive action.