Read the docs
TI-2025-34715 Aliases CVE-2025-55012

Zed AI Agent Remote Code Execution

Priority LOW 38CWE-284Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

Zed is a multiplayer code editor. Prior to version 0.197.3, in the Zed Agent Panel allowed for an AI agent to achieve Remote Code Execution (RCE) by bypassing user permission checks. An AI Agent could have exploited a permissions bypass vulnerability to create or modify a project-specific configuration file, leading to the execution of arbitrary commands on a victim's machine without the explicit approval that would otherwise be required. This vulnerability has been patched in version 0.197.3. A workaround for this issue involves either avoid sending prompts to the Agent Panel, or to limit the AI Agent's file system access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00225 13th percentileScored 2026-11-07
Fix Fixed zed (zed-industries): 0.197.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zed-industrieszedbefore 0.197.30.197.3Patch availableCNA
  • zed Vendorzed-industries Affected before 0.197.3 Fixed in 0.197.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:zed:zed:*:*:*:*:*:*:*:*——zed-industries

Remediation

  • Fix · CNA zed (zed-industries) Fixed in 0.197.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-55012

References

Other 1

  • TI-2026-32402 Zed: Allowlist Bypass via Bash Variable Expansion Chain in Terminal Tool Permissions CVSS 3.1HIGH 8.8
  • TI-2026-22318 Zed Extension Sandbox Escape via Tar Symlink Following CVSS 3.1HIGH 8.8
  • TI-2026-32405 Zed: Allowlist Bypass via Bash Arithmetic Expansion in Terminal Tool Permissions CVSS 3.1HIGH 8.6
  • TI-2026-32404 Zed: Zed IDE Arbitrary Code Execution via untrusted repository with poisoned .git/config CVSS 3.1HIGH 8.6
  • TI-2026-32403 Zed: Allowlist Bypass via Environment Variable Injection in Terminal Tool Permissions CVSS 3.1HIGH 8.6
  • TI-2026-32401 Zed: Remote Command Injection via Unquoted Environment Variable Keys (SSH / WSL Remote) CVSS 3.1HIGH 8.6
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences