CVE-2026-27976 — Zed Extension Sandbox Escape via Tar Symlink Following

Description (CNA)

Zed, a code editor, has an extension installer allows tar/gzip downloads. Prior to version 0.224.4, the tar extractor (`async_tar::Archive::unpack`) creates symlinks from the archive without validation, and the path guard (`writeable_path_from_extension`) only performs lexical prefix checks without resolving symlinks. An attacker can ship a tar that first creates a symlink inside the extension workdir pointing outside (e.g., `escape -> /`), then writes files through the symlink, causing writes to arbitrary host paths. This escapes the extension sandbox and enables code execution. Version 0.224.4 patches the issue.

Affected (CNA)

Vendor / product	Versions
zed-industries / zed	affected < 0.224.4

CWE

CWE-61

References

https://github.com/zed-industries/zed/security/advisories/GHSA-59p4-3mhm-qm3r

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.