Zed’s terminal tool permission system can be overridden by chaining bash variable expansions (${var@P}), enabling an attacker to run arbitrary commands that normally would be confined to an allowlisted prefix. The flaw does not directly expose sensitive data but allows full control over the runtime environment within the editor, thereby compromising confidentiality, integrity, and availability of local systems.

Zed Industries Zed code editor versions prior to 0.229.0 are affected. No specific patch version list is provided beyond the fix in 0.229.0.

The CVSS score of 6.4 indicates moderate to high risk. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation data. The attack vector is inferred to be local; a user with possession of the editor must inject the ${var@P} expression into a terminal session to exploit the flaw. Successful exploitation results in arbitrary command execution under the privileges of the running user within the editor’s terminal.