A flaw in Zed’s terminal tool permission system permits an attacker to embed Bash arithmetic expansion ($((…))) within an allowlisted command. This injection allows the execution of arbitrary shell commands inside the editor’s integrated terminal. The weakness is a command‑injection vulnerability (CWE‑78). Based on the description, it is inferred that the attack requires an attacker who can run a crafted command inside the Zed terminal, and that the injected commands execute with the privileges of the Zed process.

All releases of Zed Industries’ Zed editor before version 0.229.0 are vulnerable. Users on those versions should upgrade to 0.229.0 or later.

The CVSS score of 8.6 indicates high severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is local, requiring the attacker to have access to the Zed editor and its integrated terminal. The privilege impact is that injected code runs with the same rights as the Zed process, so a user running Zed with elevated privileges could lead to system compromise.