CVE-2025-68432

Zed, a code editor, has an aribtrary code execution vulnerability in versions prior to 0.218.2-pre. The Zed IDE loads Language Server Protocol (LSP) configurations from the `settings.json` file located within a project’s `.zed` subdirectory. A malicious LSP configuration can contain arbitrary shell commands that run on the host system with the privileges of the user running the IDE. This can be triggered when a user opens project file for which there is an LSP entry. A concerted effort by an attacker to seed a project settings file (`./zed/settings.json`) with malicious language server configurations could result in arbitrary code execution with the user's privileges if the user opens the project in Zed without reviewing the contents. Version 0.218.2-pre fixes the issue by implementing worktree trust mechanism. As a workaround, users should carefully review the contents of project settings files (`./zed/settings.json`) before opening new projects in Zed.

• CWE-77

• https://github.com/zed-industries/zed/security/advisories/GHSA-29cp-2hmh-hcxjExploit, Vendor Advisory
• https://zed.dev/blog/secure-by-defaultProduct, Release Notes

Published

Dec 17, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-68422Improper Authorization (CWE-285) in Kibana can lead to privi…4.3
• CVE-2025-68428jsPDF is a library to generate PDFs in JavaScript. Prior to …7.5
• CVE-2025-68429Storybook is a frontend workshop for building user interface…5.3
• CVE-2025-6843A vulnerability was found in code-projects Simple Photo Gall…9.8
• CVE-2025-68430CVAT is an open source interactive video and image annotatio…4.3
• CVE-2025-68431libheif is an HEIF and AVIF file format decoder and encoder.…7.1
• CVE-2025-68433Zed, a code editor, has an aribtrary code execution vulnerab…7.3
• CVE-2025-68434Open Source Point of Sale (opensourcepos) is a web based poi…8.8
• CVE-2025-68435Zerobyte is a backup automation tool Zerobyte versions prior…9.1
• CVE-2025-68436Craft is a platform for creating digital experiences. In ver…6.5
• CVE-2025-68437Craft is a platform for creating digital experiences. In ver…6.8
• CVE-2025-68438In Apache Airflow versions before 3.1.6, when rendered templ…7.5