CVE-2026-25805: 
NixOS vulnerability analysis and mitigation

CVE-2026-25805 is a UI transparency vulnerability in Zed, a multiplayer code editor, where the application fails to display MCP (Model Context Protocol) tool invocation parameters when requesting user confirmation or in post-execution chat history. This design flaw enables tool poisoning attacks via indirect prompt injection, where a malicious MCP server can coerce the AI agent into invoking tools with attacker-controlled parameter values that the user cannot inspect or detect. All Zed versions prior to 0.219.4 are affected (specifically noted from version 0.217.3). The vulnerability was published on February 10, 2026, and patched in version 0.219.4. The CVSS v3.1 base score is 6.4 (Moderate) per the official GitHub advisory, though Feedly estimates it at 8.0 (High) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-356 (Product UI does not Warn User of Unsafe Actions). When Zed's AI agent invokes an MCP tool, the application prompts the user for confirmation but does not display the parameter values being passed to the tool; similarly, after execution, the chat history does not record which parameter values were used. This creates a blind spot exploitable through indirect prompt injection (tool poisoning): a malicious MCP server can embed instructions that cause the AI to call tools with attacker-specified parameters (e.g., exfiltrating data to an external endpoint) while the user sees only a generic tool-call confirmation with no parameter visibility. Both users relying on manual confirmation and those using auto-confirmation are affected (GitHub Advisory).

Successful exploitation allows an attacker controlling a malicious MCP server to silently manipulate tool invocations with arbitrary parameter values, leading to potential data exfiltration, unauthorized file access, integrity violations, and other malicious actions executed through the tool mechanism — all without the user's knowledge. Both confidentiality and integrity are rated High impact, as sensitive data could be read or modified via tool calls. Users relying on Zed's AI agent with MCP integrations are at risk regardless of whether they use manual or automatic tool confirmation (GitHub Advisory, Red Hat CVE).

A proof-of-concept scenario is described in the GitHub Security Advisory (GHSA-f2g4-87h6-4pxq), demonstrating that any MCP tool invocation can be used to illustrate the parameter visibility gap. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is 0.047% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Set up a malicious MCP server: The attacker creates or compromises an MCP server that Zed's AI agent is configured to use, embedding indirect prompt injection instructions within tool descriptions or responses that instruct the AI to invoke a specific tool with attacker-controlled parameter values (e.g., a file-read tool with a path pointing to sensitive credentials).
2. Trigger AI agent interaction: The attacker causes the victim user to interact with the AI agent in Zed in a context where the malicious MCP server's tools are available — for example, by sharing a malicious project or workspace in the multiplayer editor.
3. AI agent invokes tool with malicious parameters: The AI agent, following the injected instructions, calls the target tool with attacker-specified parameters. Zed presents a confirmation dialog to the user but does not display the parameter values, so the user sees only a generic tool-call prompt.
4. User unknowingly confirms: The user approves the tool call without being able to inspect the parameters, allowing the tool to execute with the malicious values (e.g., reading a sensitive file and sending its contents to an attacker-controlled endpoint).
5. No post-execution audit trail: After execution, the chat history does not record which parameter values were used, preventing the user from detecting the malicious activity after the fact (GitHub Advisory).

• Network: Unexpected outbound connections from the Zed process to unknown external hosts, particularly following MCP tool invocations; DNS queries or HTTP requests to domains not associated with configured MCP servers.
• File System: Unexpected access to sensitive files (e.g., SSH keys, credential files, .env files) by the Zed process; new or modified files in directories not related to the active project.
• Logs: MCP server logs showing tool invocations with parameter values that were not explicitly requested by the user; Zed application logs recording tool calls with unusual or unexpected arguments.
• Process: Zed spawning unexpected child processes or making system calls inconsistent with normal editor behavior following AI agent tool confirmations (GitHub Advisory).

The primary remediation is to upgrade Zed Editor to version 0.219.4 or later, which introduces expandable tool call details that display parameter values both at the confirmation prompt and in the post-execution chat history. As a workaround prior to patching, users should avoid connecting to untrusted or third-party MCP servers, disable MCP tool integrations where not strictly necessary, and treat all AI agent tool confirmations with heightened scrutiny. Restricting MCP tool access to trusted servers and monitoring for unusual outbound network activity from the Zed process are additional precautions (GitHub Advisory).

The vulnerability was reported by security researcher m10x and coordinated by swannysec at Zed Industries, with remediation development credited to danilo-leal. The advisory was published at a Moderate severity level by the Zed team, reflecting the high-privilege and user-interaction requirements that limit practical exploitability. Coverage has appeared on security aggregation platforms including Vulners, CVEFeed, and Infinit Security, with the latter publishing a dedicated post on the MCP tool poisoning risk (GitHub Advisory, Infinit Security).