Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

zed-industries/zed

              main @ 64b8491
            

Fixes

CVEs

HIGH

Peak severity

21.1%

Coverage

Highlights

Auth Bypass: 27 prior fixes. Scrutinize any change in this area.

crates/agent/src/tool_permissions.rs: most-fixed (9 issues). Treat as high-risk during review.

38 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Command Injection: The AI agent's terminal and shell command parsing mechanisms historically permitted bypasses via arithmetic expansions, environment variable prepending, and shell substitutions. Attackers could execute arbitrary command payloads nested within what appeared to be allowlisted command patterns. This risk is highlighted by CVE-2026-44466, CVE-2026-44463, and CVE-2026-44462.

Remote Code Execution: Opening untrusted workspaces could result in arbitrary code execution by automatically spawning language or MCP servers and executing malicious configurations in .zed/settings.json or exploiting custom Git external diff commands and hook configurations. This is highlighted by CVE-2026-44465, CVE-2025-68432, and CVE-2025-68433.

Path Traversal: AI agent tools and symlink handling mechanisms allowed attackers to traverse out of the project workspace boundaries. This allowed unauthorized local file reads, writes, or deletions through unchecked symlinks, directory traversal patterns, or malicious Git submodules, as highlighted by CVE-2026-27967.