CVE-2025-68433: 
NixOS vulnerability analysis and mitigation

CVE-2025-68433 is an arbitrary code execution vulnerability in the Zed IDE affecting all versions prior to 0.218.2-pre (including the then-current stable release v0.217.2). The Zed IDE automatically loads Model Context Protocol (MCP) configurations from a project's .zed/settings.json file, and a malicious configuration can embed arbitrary shell commands that execute with the privileges of the user running the IDE simply by opening the project. The vulnerability was discovered by security researcher Aaron Portnoy at Mindgard and disclosed on December 17, 2025. It carries a CVSS v3.1 base score of 7.7 (High) per the GitHub Security Advisory (GitHub Advisory, Red Hat CVE).

The root cause is improper neutralization of special elements used in a command (CWE-77 — Command Injection). Zed's MCP feature reads context_servers entries from .zed/settings.json within a project directory and automatically spawns the configured processes (including arbitrary executables with attacker-controlled arguments and environment variables) without first verifying whether the project is trusted. An attacker can craft a malicious settings.json that specifies a shell interpreter (e.g., powershell or bash) and a script file bundled in the repository as the MCP server command; when the victim opens the project, Zed executes the command immediately and without prompting. The vulnerability was confirmed on Windows against Zed v0.212.5, but the attack surface applies cross-platform wherever Zed runs (GitHub Advisory).

Successful exploitation results in arbitrary command execution with the full privileges of the user running Zed, enabling complete confidentiality, integrity, and availability compromise of the user's system. An attacker can read or exfiltrate sensitive files, modify system or project files, install persistence mechanisms, or pivot to other systems accessible from the victim's workstation. Because developers frequently run IDEs with broad filesystem and network access, the blast radius can extend well beyond the project directory itself (GitHub Advisory, Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of disclosure (Feedly). The attack requires the victim to open a malicious project in Zed — a realistic social-engineering scenario via shared repositories, cloned open-source projects, or supply-chain attacks — but requires no additional user interaction beyond that single action. The EPSS score is approximately 0.023% (very low probability of near-term exploitation), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

1. Craft malicious project: Create or fork a repository and add a .zed/settings.json file containing a context_servers entry that specifies an arbitrary shell command (e.g., powershell with -File .\pwn.ps1 on Windows, or bash with a malicious script on Linux/macOS).
2. Bundle payload script: Include the referenced script (e.g., pwn.ps1) in the repository root or another path accessible relative to the project directory. The script can perform any action — exfiltrate credentials, establish a reverse shell, or install persistence.
3. Deliver the project to the victim: Distribute the malicious repository via GitHub, a code-sharing platform, a phishing email, or a supply-chain compromise of a legitimate project.
4. Trigger execution: When the victim opens the project in any Zed version prior to 0.218.2-pre, Zed automatically reads .zed/settings.json and spawns the configured MCP server process — executing the attacker's payload with the victim's user privileges, without any additional prompt or confirmation (GitHub Advisory).

• File System: Presence of a .zed/settings.json file in a project directory containing a context_servers block with command fields pointing to shell interpreters (powershell, bash, cmd, sh) or unexpected executables; presence of bundled script files (e.g., .ps1, .sh, .bat) referenced by such configurations.
• Process: Unexpected child processes spawned by the Zed IDE process (e.g., powershell.exe, bash, cmd.exe, python) shortly after a project is opened; unusual network connections or file writes originating from these child processes.
• Logs: System audit logs (Windows Event Log / auditd) recording process creation events with Zed as the parent process and shell interpreters or scripts as children; PowerShell script block logging entries triggered without explicit user action.
• Network: Outbound connections to unknown external IPs or domains initiated by processes spawned from Zed, particularly shortly after IDE startup or project load (GitHub Advisory).

Upgrade Zed to version 0.218.2-pre or later, which implements a worktree trust mechanism that prevents automatic execution of MCP configurations from untrusted projects. As an interim workaround, manually inspect the contents of .zed/settings.json in any project before opening it in Zed, paying particular attention to context_servers entries with command fields. Organizations should also consider implementing file integrity monitoring on .zed/settings.json files in shared or cloned repositories and restricting execution of unexpected child processes from the IDE via endpoint security controls (GitHub Advisory, Zed Blog).

Zed published a blog post titled "Secure by Default" explaining the worktree trust mechanism introduced to address this class of vulnerability (Zed Blog). The vulnerability was covered in The Hacker News' ThreatsDay bulletin and picked up by several cybersecurity news aggregators, reflecting moderate community interest given Zed's growing developer adoption (The Hacker News). Security researcher Aaron Portnoy of Mindgard was credited with the discovery in the official advisory (GitHub Advisory).