Description
Zed, a code editor, has a symlink escape vulnerability in versions prior to 0.225.9 in Agent file tools (`read_file`, `edit_file`). It allows reading and writing files **outside the project directory** when a project contains symbolic links pointing to external paths. This bypasses the intended workspace boundary and privacy protections (`file_scan_exclusions`, `private_files`), potentially leaking sensitive user data to the LLM. Version 0.225.9 fixes the issue.
INFO
Published Date :
2026-02-25T23:33:21.477Z
Last Modified :
2026-02-28T04:55:28.156Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2026-27967 vulnerability.
| Vendors | Products |
|---|---|
| Zed |
|
| Zed-industries |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-27967.
CVSS Vulnerability Scoring System
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact