CVE-2026-27976

Zed, a code editor, has an extension installer allows tar/gzip downloads. Prior to version 0.224.4, the tar extractor (`async_tar::Archive::unpack`) creates symlinks from the archive without validation, and the path guard (`writeable_path_from_extension`) only performs lexical prefix checks without resolving symlinks. An attacker can ship a tar that first creates a symlink inside the extension workdir pointing outside (e.g., `escape -> /`), then writes files through the symlink, causing writes to arbitrary host paths. This escapes the extension sandbox and enables code execution. Version 0.224.4 patches the issue.

The following products are affected by CVE-2026-27976 vulnerability.

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-27976.

URL	Resource
https://github.com/zed-industries/zed/security/advisories/GHSA-59p4-3mhm-qm3r