CVE-2025-68432: Zed IDE LSP Binary Configuration Arbitrary Code Execution

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-12-17 · updated 2026-10-13
Weakness: CWE-77

Description

Zed, a code editor, has an aribtrary code execution vulnerability in versions prior to 0.218.2-pre. The Zed IDE loads Language Server Protocol (LSP) configurations from the `settings.json` file located within a project’s `.zed` subdirectory. A malicious LSP configuration can contain arbitrary shell commands that run on the host system with the privileges of the user running the IDE. This can be triggered when a user opens project file for which there is an LSP entry. A concerted effort by an attacker to seed a project settings file (`./zed/settings.json`) with malicious language server configurations could result in arbitrary code execution with the user's privileges if the user opens the project in Zed without reviewing the contents. Version 0.218.2-pre fixes the issue by implementing worktree trust mechanism. As a workaround, users should carefully review the contents of project settings files (`./zed/settings.json`) before opening new projects in Zed.

Affected products

zed-industries zed: before 0.218.2 — fixed in 0.218.2

How to fix

Upgrade to a fixed version: zed-industries zed 0.218.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-68432 or the next vulnerability affects your stack