CVE-2025-68432
📋 TL;DR
Zed code editor versions before 0.218.2-pre have an arbitrary code execution vulnerability where malicious Language Server Protocol configurations in project settings files can execute shell commands with user privileges. This affects all users running vulnerable Zed versions who open projects containing malicious settings files. The vulnerability allows attackers to run arbitrary code on the host system.
💻 Affected Systems
- Zed IDE
📦 What is this software?
Zed by Zed
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the user's system, data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation leading to data exfiltration, credential theft, or installation of persistent backdoors on developer workstations.
If Mitigated
No impact if using patched version or if users carefully review all project settings files before opening projects.
🎯 Exploit Status
Exploitation requires user interaction (opening a malicious project) but the payload execution is straightforward once triggered.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.218.2-pre
Vendor Advisory: https://github.com/zed-industries/zed/security/advisories/GHSA-29cp-2hmh-hcxj
Restart Required: Yes
Instructions:
1. Update Zed to version 0.218.2-pre or later. 2. Restart the Zed application. 3. Verify the update by checking the version in Zed's about dialog.
🔧 Temporary Workarounds
Manual settings review
allCarefully review contents of project settings files before opening new projects in Zed
cat .zed/settings.json
type .zed\settings.json
🧯 If You Can't Patch
- Avoid opening untrusted projects or repositories in Zed
- Use alternative code editors for projects from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check Zed version in application settings or via 'zed --version' command lineCheck Version:
zed --versionVerify Fix Applied:
Confirm version is 0.218.2-pre or later and that worktree trust mechanism is enabled📡 Detection & Monitoring
Log Indicators:
- Unusual shell command execution from Zed process
- Suspicious LSP configuration loading
Network Indicators:
- Unexpected outbound connections from Zed process
SIEM Query:
process_name:zed AND (cmdline:*sh* OR cmdline:*bash* OR cmdline:*powershell*)