CVE-2026-27800: 
NixOS vulnerability analysis and mitigation

CVE-2026-27800 is a Zip Slip (Path Traversal) vulnerability in the Zed code editor's extension archive extraction functionality, affecting all versions prior to 0.224.4. The flaw resides in the extract_zip() function within crates/util/src/archive.rs, which fails to validate ZIP entry filenames for path traversal sequences such as ../. It was published on February 25–26, 2026, with a fix released in version 0.224.4. The vulnerability carries a CVSS v3.1 base score of 7.4 (High) (GitHub Advisory, Red Hat CVE).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), where the extract_zip() function joins the destination path with raw ZIP entry filenames from entry.filename().as_str() without sanitizing path traversal sequences. This flaw exists in both the Windows (lines 20–25) and Unix (lines 82–87) implementations of crates/util/src/archive.rs. Although Zed implements sandbox validation via writeable_path_from_extension() in crates/extension_host/src/wasm_host.rs, this check only validates the destination directory parameter provided by the extension — not individual filenames within the ZIP archive. The async_zip library (version 0.0.18) used by Zed explicitly does not implement Zip Slip protections, placing the validation burden on the application developer (GitHub Advisory).

A malicious Zed extension can write arbitrary files outside its designated sandbox directory by serving a crafted ZIP archive containing path traversal entries (e.g., ../../escaped.txt). This enables configuration tampering (overwriting Zed settings files), credential theft (placing malicious files in locations that may be executed or sourced), and supply chain attacks via compromised extension repositories. The integrity impact is rated High, as an attacker can achieve arbitrary file writes within the scope of the user's filesystem permissions, effectively bypassing Zed's extension isolation model (GitHub Advisory).

A public proof-of-concept (PoC) is included in the GitHub Security Advisory, demonstrating exploitation using a malicious Python HTTP server and a crafted Zed extension. Exploitation requires the victim to install a malicious third-party extension, making user interaction a prerequisite, but no elevated privileges are needed beyond that action. The EPSS score is approximately 0.031% (0.000310), indicating low current probability of widespread exploitation. No in-the-wild exploitation or CISA KEV catalog listing has been reported as of the time of disclosure (GitHub Advisory).

1. Set up a malicious HTTP server: Create a Python HTTP server (malicious_server.py) that dynamically generates and serves a crafted ZIP archive containing path traversal entries such as ../escaped_level1.txt and ../../escaped_level2.txt alongside a legitimate file.
2. Create a malicious Zed extension: Develop a Zed extension (in Rust, compiled to wasm32-wasip1) that, upon loading, calls zed::download_file() targeting the attacker-controlled HTTP server with DownloadedFileType::Zip as the file type.
3. Distribute or install the extension: Package the extension and either publish it to a repository or socially engineer the victim into installing it via Zed's "Install Dev Extension" feature (zed: install dev extension in the Command Palette).
4. Trigger extraction: When the victim installs and loads the extension, Zed automatically calls extract_zip(), which extracts the ZIP entries — including those with ../ sequences — without path validation, writing files outside the extension's sandbox directory.
5. Verify file escape: Confirm that files such as escaped_level2.txt appear in the parent work/ directory (e.g., ~/Library/Application Support/Zed/extensions/work/ on macOS) rather than the extension's designated subdirectory, demonstrating arbitrary file write (GitHub Advisory).

• File System: Unexpected files appearing in ~/Library/Application Support/Zed/extensions/work/ (macOS) or ~/.local/share/zed/extensions/work/ (Linux) outside of named extension subdirectories; files with names like escaped_level1.txt or escaped_level2.txt in parent directories of the extension sandbox.
• Network: Outbound HTTP requests from the Zed process to unexpected or attacker-controlled hosts serving ZIP files, particularly during extension installation or load.
• Logs: Zed extension host logs showing download_file calls to non-standard or external URLs; errors from writeable_path_from_extension() if partial validation triggers; unexpected file creation events logged by filesystem auditing tools (e.g., macOS FSEvents, Linux inotify/auditd).
• Process: Zed spawning file write operations to paths outside the expected extension work directory during extension initialization (GitHub Advisory).

Users should upgrade Zed to version 0.224.4 or later, which resolves the vulnerability by adding path traversal validation in crates/util/src/archive.rs before file creation. The fix rejects ZIP entries containing .. sequences or absolute paths and performs a canonical path check to ensure the resolved path remains within the destination directory. As a workaround prior to patching, users should avoid installing untrusted or unverified third-party Zed extensions (GitHub Advisory).

The vulnerability was reported by security researcher yueyueL and coordinated by swannysec and jayasuryajsk via GitHub's security advisory process. Red Hat has tracked the CVE in their security database. Tenable has added detection support via Nessus plugin 300838. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability aggregator coverage (GitHub Advisory, Red Hat CVE, Tenable Nessus).