Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2026-44465

Zed: Zed IDE Arbitrary Code Execution via untrusted repository with poisoned .git/config

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Zed is a code editor. Prior to 0.227.1, Zed IDE executes arbitrary commands when opening a folder with a malicious .git/config file that abuses the core.fsmonitor Git configuration option. This allows an attacker to achieve Remote Code Execution (RCE) when a victim open a folder in untrusted mode. This vulnerability is fixed in 0.227.1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

zed-industries zed

  • < 0.227.1affected

References