CVE-2025-68433
📋 TL;DR
Zed code editor versions before 0.218.2-pre have an arbitrary code execution vulnerability where malicious MCP configurations in project settings files can execute shell commands automatically when opening projects. This affects all users running vulnerable versions of Zed, particularly developers working with untrusted projects.
💻 Affected Systems
- Zed
📦 What is this software?
Zed by Zed
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the host system with the privileges of the user running Zed, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Attackers could steal credentials, install malware, or exfiltrate sensitive project data when developers open malicious projects from untrusted sources.
If Mitigated
With proper controls, the risk is limited to isolated development environments with minimal privileges and no access to production systems.
🎯 Exploit Status
Exploitation requires user interaction (opening a malicious project) but no authentication. The attack vector is simple and reliable once malicious settings are in place.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.218.2-pre
Vendor Advisory: https://github.com/zed-industries/zed/security/advisories/GHSA-cv6g-cmxc-vw8j
Restart Required: Yes
Instructions:
1. Update Zed to version 0.218.2-pre or later. 2. Restart the Zed application. 3. Verify the update by checking the version in Zed's about dialog.
🔧 Temporary Workarounds
Manual settings review
allManually inspect .zed/settings.json files in all projects before opening them in Zed
cat .zed/settings.json
type .zed\settings.json
🧯 If You Can't Patch
- Avoid opening projects from untrusted sources or repositories
- Run Zed with minimal user privileges and in isolated environments
🔍 How to Verify
Check if Vulnerable:
Check Zed version in Help > About or run 'zed --version' in terminal. If version is below 0.218.2-pre, you are vulnerable.Check Version:
zed --versionVerify Fix Applied:
Confirm Zed version is 0.218.2-pre or higher. The worktree trust mechanism will prompt for trust when opening projects with MCP configurations.📡 Detection & Monitoring
Log Indicators:
- Unexpected shell command execution from Zed process
- Creation of suspicious files or processes by Zed
Network Indicators:
- Unusual outbound connections from Zed process to external servers
SIEM Query:
process_name:zed AND (command_line:*cmd* OR command_line:*sh* OR command_line:*powershell*)