CVE-2026-27967 – Zed code editor versions before 0.225.9 have a ... (How to Fix)

Q: What is the severity of CVE-2026-27967?

CVE-2026-27967 has a CVSS score of 7.1 (HIGH). Zed code editor versions before 0.225.9 have a symlink escape vulnerability that allows reading and writing files outside the project directory when symbolic links point to external paths. This bypasses workspace boundaries and privacy protections, potentially exposing sensitive user data to the LLM. All users running affected versions are vulnerable.

📋 TL;DR

Zed code editor versions before 0.225.9 have a symlink escape vulnerability that allows reading and writing files outside the project directory when symbolic links point to external paths. This bypasses workspace boundaries and privacy protections, potentially exposing sensitive user data to the LLM. All users running affected versions are vulnerable.

💻 Affected Systems

Products:

Zed

Versions: All versions prior to 0.225.9

Operating Systems: All platforms where Zed runs

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability requires a project containing symbolic links pointing to external paths to be exploited.

📦 What is this software?

Zed by Zed

View all CVEs affecting Zed →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could read sensitive system files (passwords, SSH keys, configuration files) or write malicious files to critical system locations, leading to complete system compromise.

🟠

Likely Case

Unauthorized access to user files outside the project directory, potentially exposing personal documents, configuration files, or other sensitive data stored on the system.

🟢

If Mitigated

Limited to accessing only files within the project directory as intended, with privacy protections functioning correctly.

🌐 Internet-Facing: LOW

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires user interaction with a malicious project containing symlinks.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 0.225.9

Vendor Advisory: https://github.com/zed-industries/zed/security/advisories/GHSA-786m-x2vc-5235

Restart Required: Yes

Instructions:

1. Open Zed. 2. Go to Settings/Preferences. 3. Check for updates. 4. Install version 0.225.9 or later. 5. Restart Zed.

🔧 Temporary Workarounds

Avoid untrusted projects with symlinks

all

Do not open projects containing symbolic links from untrusted sources.

Disable Agent file tools

all

Temporarily disable the vulnerable Agent file tools if available in settings.

🧯 If You Can't Patch

Avoid opening projects with symbolic links from untrusted sources.
Use Zed in isolated environments or sandboxes when working with untrusted projects.

🔍 How to Verify

Check if Vulnerable:

Check Zed version in Settings/Preferences → About. If version is below 0.225.9, you are vulnerable.

Check Version:

zed --version

Verify Fix Applied:

Confirm version is 0.225.9 or higher in Settings/Preferences → About.

📡 Detection & Monitoring

Log Indicators:

Unusual file access patterns outside project directories
Errors related to symlink resolution in Agent tools

Network Indicators:

None - this is a local vulnerability

SIEM Query:

Not applicable for local file access vulnerability

📊 Metadata

CVE ID: CVE-2026-27967

CVSS v3 Score: 7.1 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE: CWE-59

Published: February 26, 2026

Last Updated: March 5, 2026

🔗 References

https://github.com/zed-industries/zed/security/advisories/GHSA-786m-x2vc-5235 Vendor Advisory,Exploit,Mitigation

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2026-27967, you might also want to check these: