Zed IDE Remote Code Execution Vulnerability via Malicious Git Configuration

A remote code execution vulnerability exists in Zed IDE versions prior to 0.227.1. The issue arises when the application opens a folder containing a malicious .git/config file that exploits the core.fsmonitor Git configuration option. In untrusted mode, Zed executes arbitrary commands embedded in the poisoned configuration, potentially leading to full system compromise.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the user's system with their privileges.

Reproduction

To reproduce this vulnerability, create a Git repository and inject a malicious command into the .git/config file under the core.fsmonitor option. Then, open the repository in Zed IDE's untrusted mode. The injected command will be executed, confirming the vulnerability.

Remediation

Users can update to Zed IDE version 0.227.1 or later to address this vulnerability.