CVE-2025-68432: 
NixOS vulnerability analysis and mitigation

CVE-2025-68432 is an arbitrary code execution vulnerability in the Zed IDE that allows attackers to execute shell commands with the privileges of the user running the IDE by planting a malicious LSP (Language Server Protocol) configuration in a project's .zed/settings.json file. It affects all Zed versions prior to v0.218.2-pre, including the then-current stable release v0.217.2. The vulnerability was discovered by security researcher Aaron Portnoy at Mindgard and disclosed on December 17, 2025. It carries a CVSS v3.1 base score of 7.3–7.7 (High), depending on the scoring source (GitHub Advisory, Red Hat).

The root cause is improper neutralization of special elements used in a command (CWE-77 — Command Injection). Zed automatically loads LSP configurations from .zed/settings.json within a project directory, and the lsp configuration block allows specifying an arbitrary binary path and arguments for any language server. Because these values are passed directly to the OS without sanitization or user confirmation, an attacker can replace a legitimate LSP binary path (e.g., rust-analyzer) with any executable (e.g., powershell) and supply arbitrary arguments or scripts. Exploitation is triggered simply by a user opening a project file that matches a configured LSP language entry — no further interaction is required beyond opening the project (GitHub Advisory). The vulnerability was confirmed on Windows against Zed v0.212.5, but the attack surface applies cross-platform given Zed's architecture.

Successful exploitation results in arbitrary code execution with the full privileges of the user running Zed, impacting confidentiality, integrity, and availability of the affected system. An attacker can read, modify, or delete files accessible to the user, install persistent malware, exfiltrate credentials or source code, or use the compromised developer workstation as a pivot point for lateral movement into internal networks or CI/CD pipelines. The attack is particularly dangerous in supply chain scenarios where a malicious .zed/settings.json is committed to a shared or open-source repository, potentially affecting all developers who clone and open the project (GitHub Advisory, Red Hat).

A proof-of-concept payload is publicly documented in the GitHub Security Advisory, demonstrating exploitation via a crafted settings.json and a companion PowerShell script (GitHub Advisory). The EPSS score is 0.023% (very low), and there is no current evidence of in-the-wild exploitation or CISA KEV catalog listing. Exploitation requires low attacker privileges (ability to write to a project repository) and user interaction (opening the project in Zed), but no special knowledge of the target system is needed. The attack is well-suited to supply chain or social engineering scenarios targeting developers.

1. Prepare malicious project: The attacker creates or forks a repository and adds a .zed/settings.json file containing a malicious LSP configuration that replaces a legitimate language server binary with an attacker-controlled executable or script.
2. Craft the payload: Example settings.json targeting Rust projects on Windows:

{
  "lsp": {
    "rust-analyzer": {
      "binary": {
        "path": "powershell",
        "arguments": ["-NonInteractive", "-NoProfile", "-ExecutionPolicy", "Bypass", "-File", ".\\lsp-pwn.ps1"]
      }
    }
  },
  "languages": {
    "Rust": { "language_servers": ["rust-analyzer"] }
  }
}

3. Include the payload script: Add lsp-pwn.ps1 (or equivalent shell script on Linux/macOS) to the repository root with the desired malicious commands (e.g., data exfiltration, reverse shell, credential theft).
4. Distribute the project: Share the repository via GitHub, a package registry, a code review invitation, or a phishing link targeting developers.
5. Trigger execution: When the victim opens any Rust source file (or other language file matching the LSP entry) in Zed, the IDE automatically spawns the configured binary — executing the attacker's script with the user's OS privileges, without any warning or prompt (GitHub Advisory).

• File System: Presence of a .zed/settings.json file in a project directory with an lsp block specifying an unusual or non-standard binary.path (e.g., powershell, bash, cmd, or a relative path script); unexpected script files (.ps1, .sh, .bat) in the project root alongside a .zed/ directory.
• Process: Unexpected child processes spawned by the Zed IDE process — particularly powershell.exe, cmd.exe, bash, sh, curl, wget, or other utilities not typical of language server operation; language server processes with anomalous command-line arguments.
• Network: Outbound connections from the Zed process or its child processes to unknown external IPs or domains shortly after opening a project; DNS queries for attacker-controlled infrastructure initiated by shell processes.
• Logs: OS process creation logs (e.g., Windows Event ID 4688, Sysmon Event ID 1) showing Zed spawning shell interpreters with script arguments; endpoint detection alerts on script execution from IDE working directories.

Zed version v0.218.2-pre addresses the vulnerability by implementing a worktree trust mechanism that prompts users before applying project-level settings, preventing automatic execution of untrusted LSP configurations (GitHub Advisory, Zed Blog). Users unable to upgrade immediately should manually review the contents of any .zed/settings.json file before opening a new or untrusted project in Zed, paying particular attention to the lsp.*.binary.path and lsp.*.binary.arguments fields. Organizations should also consider restricting developer workstations from executing scripts from project directories via application control policies (e.g., AppLocker, WDAC on Windows).

Zed published a blog post titled "Secure by Default" describing the trust mechanism introduced to address this class of vulnerability (Zed Blog). The vulnerability was reported by Aaron Portnoy at Mindgard and coordinated through GitHub's security advisory process. Coverage appeared in threat intelligence roundups including The Hacker News' ThreatsDay bulletin and community discussion on Mastodon/Infosec.exchange, reflecting moderate interest in the developer tooling security community (The Hacker News).