Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Zed is a code editor. Prior to 0.227.1, Zed builds SSH/WSL remote commands as a shell command string that starts with exec env ..., but environment variable keys are inserted without shell quoting or validation. If an attacker can control an environment variable key (for example via project terminal settings), shell expansions in the key (such as $(...)) are evaluated by the remote shell when a terminal is opened. This can lead to arbitrary command execution on the remote host under the victim user's account. This vulnerability is fixed in 0.227.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 HIGH: CVE-2026-44461 (CVSS 8.6) - Zed code editor RCE via SSH/WSL commands. Unquoted env vars allow arbitrary command execution on remote hosts. Fixed in v0.227.1. Patch immediately. #CVE #PatchNow #ThreatIntel https://t.co/vneIV9tyTU
Post summary
The tweet warns of CVE‑2026‑44461, a high‑severity RCE in Zed code editor, and urges users to apply the version 0.227.1 patch immediately.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | zed | zed | - | - | - |