CVE-2026-27967: 
NixOS vulnerability analysis and mitigation

CVE-2026-27967 is a symlink escape vulnerability in Zed, an open-source code editor, affecting the Agent file tools (read_file, edit_file). It allows reading and writing files outside the intended project directory when a project contains symbolic links pointing to external paths, bypassing workspace boundary and privacy protections (file_scan_exclusions, private_files). All Zed versions prior to 0.225.9 are affected. The vulnerability was published on February 25–26, 2026, and carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Red Hat CVE).

The root cause is CWE-59 (Improper Link Resolution Before File Access). Zed's Agent tools validate file paths using worktree-relative paths and exclusion patterns, but Worktree::absolutize() simply concatenates path components without resolving or canonicalizing symlinks. As a result, when the OS follows a symlink during file access, it can traverse outside the project root. Critically, the codebase already tracks external symlinks via the Entry.is_external field, but this flag is never enforced in the agent tools (ReadFileTool::run, EditFileTool). The vulnerability persists even when the project is opened in Restricted Mode (untrusted project), as that mode does not prevent symlink traversal by the Agent (GitHub Advisory).

Successful exploitation allows an attacker to exfiltrate sensitive files from outside the project directory to the LLM context, including SSH private keys (~/.ssh/id_rsa), cloud credentials (~/.aws/credentials, ~/.config/gcloud/), git credentials (~/.gitconfig, ~/.git-credentials), shell history, and system files such as /etc/passwd. Additionally, the edit_file tool can be abused to write to files outside the project boundary, enabling integrity violations. Any user who opens a malicious project containing crafted symlinks and interacts with the Agent feature is at risk, making supply-chain-style attacks via malicious repositories a realistic threat scenario (GitHub Advisory).

A public proof-of-concept is included in the GitHub Security Advisory itself, demonstrating the full attack chain. The vulnerability requires local access (the victim must open a malicious project) and user interaction (the victim must invoke the Agent), which limits remote exploitability. No in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.012% (0.000120), indicating a low probability of near-term automated exploitation (GitHub Advisory, Feedly).

1. Craft a malicious repository: Create a project directory with legitimate-looking files and embed symbolic links pointing to sensitive files outside the project, e.g.:

   mkdir -p poc-symlink/docs poc-symlink/src
   ln -s ~/.ssh/id_rsa poc-symlink/docs/ssh_key.txt
   ln -s ~/.aws/credentials poc-symlink/docs/aws_creds.txt
   ln -s /etc/passwd poc-symlink/docs/passwd_leak.txt

2. Distribute the repository: Publish the malicious repository to a public platform (GitHub, GitLab, etc.) or deliver it via social engineering.
3. Victim opens the project: The victim clones the repository and opens it in Zed (zed .). Opening in Restricted Mode does NOT prevent exploitation.
4. Trigger Agent file access: The victim interacts with the Zed Agent (e.g., asks it to "read the docs", "summarize the project", or "review docs/ssh_key.txt"). The Agent calls read_file on the symlinked path.
5. Exfiltrate sensitive data: The Agent follows the symlink, reads the target file outside the project boundary, and returns its contents to the LLM context. The attacker can further exfiltrate this data via prompt injection techniques embedded in the repository files (GitHub Advisory).

• File System: Presence of symbolic links within a cloned repository pointing to paths outside the project directory (e.g., docs/readme.txt -> ~/.ssh/id_rsa); unexpected access timestamps on sensitive files such as ~/.ssh/id_rsa, ~/.aws/credentials, or /etc/passwd.
• Logs: OS-level file access audit logs (e.g., macOS Unified Log, Linux auditd) showing the Zed process (zed) reading files outside its project directory via symlink resolution.
• Process: Zed process accessing file paths such as /etc/passwd, ~/.ssh/id_rsa, ~/.aws/credentials, or ~/.gitconfig that are not within the opened project root (GitHub Advisory).

Upgrade Zed to version 0.225.9 or later, which resolves the issue by enforcing the existing Entry.is_external flag in agent file tools to block access to symlinks pointing outside the project boundary. No configuration-based workaround fully mitigates the issue — notably, Restricted Mode does not prevent exploitation. As a precautionary measure, users should avoid opening untrusted repositories in Zed and refrain from using the Agent feature on projects from unknown sources until upgraded (GitHub Advisory).

The advisory was published by swannysec on GitHub on February 25, 2026, with the reporter credited as yueyueL and remediation developer as benbrandt. The vulnerability drew attention from security aggregators including Tenable (Nessus plugin 300255), Red Hat CVE tracking, and ENISA's EUVD database (EUVD-2026-8777). A Bluesky post from cyberhub.blog noted the disclosure, and the issue was covered by security news aggregator infinitsec.net. Community reaction highlighted the irony that the codebase already contained the is_external tracking field but failed to enforce it in agent tools (GitHub Advisory, Tenable).