CVE-2025-68432

Name of the Vulnerable Software and Affected Versions Zed versions prior to 0.218.2-pre

Description An arbitrary code execution issue exists when the IDE loads Language Server Protocol (LSP) configurations from the settings.json file located within a project's .zed subdirectory. A malicious configuration in this file can contain shell commands that execute on the host system with the privileges of the user running the IDE. This occurs when a user opens a project file that contains an LSP entry. An attacker can seed the settings.json file with malicious configurations to execute code if the user opens the project without reviewing the file contents.

Recommendations Update to version 0.218.2-pre or later. As a temporary workaround, carefully review the contents of the settings.json file within the .zed subdirectory before opening new projects.