CVE-2026-25805: zed — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2026-25805

CVSS 8.0 · High EPSS 0,44%

Kerentanan Product UI does not Warn User of Unsafe Actions pada zed. Skor CVSS 3.1 8.0 (High) menurut NVD.

Deskripsi (NVD)

Zed is a multiplayer code editor. Prior to 0.219.4, Zed does not show with which parameters a tool is being invoked, when asking for allowance. Further it does not show after the tool was being invoked, which parameters were used. Thus, maybe unwanted or even malicious values could be used without the user having a chance to notice it. Patched in Zed Editor 0.219.4 which includes expandable tool call details.

Rincian

Terbit di NVD: 10 Februari 2026
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.0 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-356: Product UI does not Warn User of Unsafe Actions
EPSS (30 hari): 0,44% peluang dieksploitasi; lebih tinggi dari 36,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
zed	zed	Semua versi sebelum 0.219.4

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/zed-industries/zed/security/advisories/GHSA-f2g4-87h6-4pxq exploit · advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.