CVE-2026-27976

Zed, a code editor, has an extension installer allows tar/gzip downloads. Prior to version 0.224.4, the tar extractor (`async_tar::Archive::unpack`) creates symlinks from the archive without validation, and the path guard (`writeable_path_from_extension`) only performs lexical prefix checks without resolving symlinks. An attacker can ship a tar that first creates a symlink inside the extension workdir pointing outside (e.g., `escape -> /`), then writes files through the symlink, causing writes to arbitrary host paths. This escapes the extension sandbox and enables code execution. Version 0.224.4 patches the issue.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/zed-industries/zed/security/advisories/GHSA-59p4-3mhm-qm3r	Vendor Advisory Exploit Mitigation

Configurations

Configuration 1 (hide)

cpe:2.3:a:zed:zed:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-02-26 00:16

Updated : 2026-03-05 16:08

NVD link : CVE-2026-27976

Mitre link : CVE-2026-27976

CVE.ORG link : CVE-2026-27976

JSON object : View

Products Affected

zed

zed

CWE

CWE-61

UNIX Symbolic Link (Symlink) Following

{"id": "CVE-2026-27976", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2026-02-26T00:16:27.293", "references": [{"url": "https://github.com/zed-industries/zed/security/advisories/GHSA-59p4-3mhm-qm3r", "tags": ["Vendor Advisory", "Exploit", "Mitigation"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-61"}]}], "descriptions": [{"lang": "en", "value": "Zed, a code editor, has an extension installer allows tar/gzip downloads. Prior to version 0.224.4, the tar extractor (`async_tar::Archive::unpack`) creates symlinks from the archive without validation, and the path guard (`writeable_path_from_extension`) only performs lexical prefix checks without resolving symlinks. An attacker can ship a tar that first creates a symlink inside the extension workdir pointing outside (e.g., `escape -> /`), then writes files through the symlink, causing writes to arbitrary host paths. This escapes the extension sandbox and enables code execution. Version 0.224.4 patches the issue."}, {"lang": "es", "value": "Zed, un editor de c\u00f3digo, tiene un instalador de extensiones que permite descargas tar/gzip. Antes de la versi\u00f3n 0.224.4, el extractor de tar ('async_tar::Archive::unpack') crea enlaces simb\u00f3licos (symlinks) desde el archivo sin validaci\u00f3n, y el protector de rutas ('writeable_path_from_extension') solo realiza comprobaciones de prefijo l\u00e9xico sin resolver enlaces simb\u00f3licos (symlinks). Un atacante puede enviar un tar que primero crea un enlace simb\u00f3lico (symlink) dentro del directorio de trabajo de la extensi\u00f3n apuntando hacia afuera (por ejemplo, 'escape -> /'), luego escribe archivos a trav\u00e9s del enlace simb\u00f3lico (symlink), provocando escrituras en rutas de host arbitrarias. Esto escapa de la sandbox de la extensi\u00f3n y permite la ejecuci\u00f3n de c\u00f3digo. La versi\u00f3n 0.224.4 soluciona el problema."}], "lastModified": "2026-03-05T16:08:38.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zed:zed:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63C50DD7-F03F-4305-94DE-F5BFF201BA6A", "versionEndExcluding": "0.224.4"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}