Remote Code Execution Vulnerability in Zed by Zed Industries

CVE-2025-55012

What is CVE-2025-55012?

Zed is a multiplayer code editor that contains a vulnerability within the Zed Agent Panel. Before version 0.197.3, this issue allowed an AI agent to exploit a permissions bypass, which could lead to remote code execution on a user's machine. An attacker could manipulate the agent to modify a project-specific configuration file without proper authorization. This exploitation could result in executing arbitrary commands, compromising the security of the user's system. Users are advised to update to version 0.197.3 or implement workarounds, such as restricting the AI agent's access to the file system or avoiding prompts to the Agent Panel to mitigate the risk.

References