CVE-2026-27976 - Vulnerability Analysis

Overview

Zed code editor < 0.224.4 contains a path traversal caused by improper symlink validation in tar extraction, letting attackers write files outside the extension sandbox and execute code, exploit requires crafted tar archive.

Severity & Score

Impact

Attackers can write files outside the sandbox, leading to arbitrary code execution and full system compromise.

Mitigation

Update to version 0.224.4 or later.

References

• https://github.com/zed-industries/zed/security/advisories/GHSA-59p4-3mhm-qm3r

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 26, 2026

🟠 CVE-2026-27976 - High (8.8) Zed, a code editor, has an extension installer allows tar/gzip downloads. Prior to version 0.224.4, the tar extractor (`async_tar::Archive::unpack`) creates symlinks from the archive without validation, and the path guard (`writeable_path_from_ext... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27976/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner