Zed Code Editor: Malicious Extensions Can Write Outside Sandbox

Summary

If you use Zed Code Editor version 0.224.4 or earlier, a malicious extension can write files to any location on your system by tricking the editor into extracting a specially crafted ZIP archive. This could allow an attacker to steal your sensitive data or take control of your system. Update to version 0.224.4 or later to fix this issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
zed	zed	<= 0.224.4	–

Original title

Zed, a code editor, has a Zip Slip (Path Traversal) vulnerability exists in its extension archive extraction functionality prior to version 0.224.4. The `extract_zip()` function in `crates/util/src...

Original description

Zed, a code editor, has a Zip Slip (Path Traversal) vulnerability exists in its extension archive extraction functionality prior to version 0.224.4. The `extract_zip()` function in `crates/util/src/archive.rs` fails to validate ZIP entry filenames for path traversal sequences (e.g., `../`). This allows a malicious extension to write files outside its designated sandbox directory by downloading and extracting a crafted ZIP archive. Version 0.224.4 fixes the issue.

nvd CVSS3.1 7.4

Vulnerability type

CWE-22 Path Traversal

https://github.com/zed-industries/zed/security/advisories/GHSA-v385-xh3h-rrfr Vendor Advisory Exploit