How severe is CVE-2026-44461?

CVE-2026-44461 has a CVSS 3.x base score of 8.6, rated high severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-44461 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (18th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-44461?

CVE-2026-44461 affects Zed. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-44461?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2026-44461 have an EU (EUVD) identifier?

Yes. CVE-2026-44461 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-32936.

When was CVE-2026-44461 published?

CVE-2026-44461 was published on 2026-05-28 and last updated on 2026-06-17.

CVE-2026-44461

CVE-2026-44461 is a high-severity vulnerability in Zed with a CVSS 3.x base score of 8.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-78.

Key facts

Severity: High (CVSS 3.x base score 8.6)
EPSS exploit prediction: 0% (18th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-32936
Weakness: CWE-78
Affected product: Zed
Published: 2026-05-28
Last modified: 2026-06-17

Description

Zed is a code editor. Prior to 0.227.1, Zed builds SSH/WSL remote commands as a shell command string that starts with exec env ..., but environment variable keys are inserted without shell quoting or validation. If an attacker can control an environment variable key (for example via project terminal settings), shell expansions in the key (such as $(...)) are evaluated by the remote shell when a terminal is opened. This can lead to arbitrary command execution on the remote host under the victim user's account. This vulnerability is fixed in 0.227.1.

Frequently asked questions

What is CVE-2026-44461?: Zed is a code editor. Prior to 0.227.1, Zed builds SSH/WSL remote commands as a shell command string that starts with exec env ..., but environment variable keys are inserted without shell quoting or validation. If an attacker can control an environment variable key (for example via project terminal settings), shell expansions in the key (such as $(...)) are evaluated by the remote shell when a terminal is opened. This can lead to arbitrary command execution on the remote host under the victim user's account. This vulnerability is fixed in 0.227.1.
How severe is CVE-2026-44461?: CVE-2026-44461 has a CVSS 3.x base score of 8.6, rated high severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-44461 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (18th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-44461?: CVE-2026-44461 affects Zed. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-44461?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-44461 have an EU (EUVD) identifier?: Yes. CVE-2026-44461 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-32936.
When was CVE-2026-44461 published?: CVE-2026-44461 was published on 2026-05-28 and last updated on 2026-06-17.

References

https://github.com/zed-industries/zed/security/advisories/GHSA-63qj-jc2q-7hg5

Affected products (1)

cpe:2.3:a:zed:zed:*:*:*:*:*:*:*:*

More vulnerabilities in Zed

CVE-2026-27976 — High (CVSS 8.8): Zed, a code editor, has an extension installer allows tar/gzip downloads. Prior to version 0.224.4, the tar extractor…
CVE-2026-44466 — High (CVSS 8.6): Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission system can be bypassed via bash arithmetic…
CVE-2026-44465 — High (CVSS 8.6): Zed is a code editor. Prior to 0.227.1, Zed IDE executes arbitrary commands when opening a folder with a malicious…
CVE-2026-44463 — High (CVSS 8.6): Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission system can be bypassed by prepending environment…
CVE-2025-68433 — High (CVSS 7.7): Zed, a code editor, has an aribtrary code execution vulnerability in versions prior to 0.218.2-pre. The Zed IDE loads…
CVE-2025-68432 — High (CVSS 7.7): Zed, a code editor, has an aribtrary code execution vulnerability in versions prior to 0.218.2-pre. The Zed IDE loads…

All CVEs affecting Zed →

Other CWE-78 (OS Command Injection) vulnerabilities

CVE-2026-19188 — Critical (CVSS 10.0): A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The…
CVE-2026-48362 — Critical (CVSS 10.0): ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')…
CVE-2026-16812 — Critical (CVSS 10.0): VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access…
CVE-2026-6516 — Critical (CVSS 10.0): Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to…
CVE-2026-46339 — Critical (CVSS 10.0): 9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect…
CVE-2026-59726 — Critical (CVSS 10.0): Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-compose deployment…

Browse all CWE-78 (OS Command Injection) vulnerabilities →