CVE-2026-27976: 
NixOS vulnerability analysis and mitigation

CVE-2026-27976 is a symlink-following (path traversal) vulnerability in the Zed code editor's extension installer that allows an attacker to escape the extension sandbox and achieve arbitrary file writes and remote code execution. It affects all Zed versions prior to 0.224.4. The vulnerability was published on February 25–26, 2026, and patched in version 0.224.4. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-61 (UNIX Symbolic Link Following). Two vulnerable code paths interact to enable exploitation: crates/fs/src/fs.rs calls async_tar::Archive::unpack without any path or symlink validation, and writeable_path_from_extension in crates/extension_host/src/wasm_host.rs performs only lexical prefix checks without canonicalizing paths, meaning symlinks planted inside the extension workdir are followed transparently. An attacker crafts a malicious tar archive that first creates a symlink inside the extension workdir pointing to the filesystem root (e.g., evil/escape -> /), then includes a file entry written through that symlink (e.g., evil/escape/tmp/payload.txt), causing writes to arbitrary host paths outside the sandbox. Exploitation requires user interaction — specifically, the victim must install the malicious extension — but no privileges are required (GitHub Advisory).

Successful exploitation allows an attacker to write arbitrary files anywhere on the host system with the privileges of the user running Zed, fully escaping the extension sandbox. Concrete post-exploitation scenarios include overwriting shell initialization files (~/.bashrc, ~/.zshrc, ~/.zprofile) for code execution on next terminal launch, writing to ~/.config/autostart/ for persistence on next login, hijacking the PATH via ~/.local/bin/, and modifying git hooks or SSH configuration. This results in high confidentiality, integrity, and availability impact, and can lead to full user-level system compromise, data theft, or malware installation (GitHub Advisory, Feedly).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating the full attack chain using a Python script to craft the malicious tar and a Rust harness to trigger extraction (GitHub Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.042% (low probability of near-term exploitation). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Nessus detection plugin 300838 is available for scanning (Tenable).

1. Craft malicious tar archive: Use Python's tarfile module to create a tar that first adds a symlink entry (evil/escape) pointing to the filesystem root (/), then adds a file entry (evil/escape/tmp/payload.txt) written through that symlink to an arbitrary host path.
2. Host the malicious archive: Serve the crafted tar/gzip file from an attacker-controlled server or package it as a Zed extension available via the extension marketplace or a direct URL.
3. Social engineer the victim: Convince the target Zed user to install the malicious extension (e.g., via a typosquatted extension name, a phishing link, or a compromised extension repository).
4. Trigger extraction: When the victim installs the extension, Zed's extension installer calls fs.extract_tar_file, which invokes async_tar::Archive::unpack without symlink validation, extracting the archive into the extension workdir.
5. Symlink is followed: The path guard writeable_path_from_extension performs only a lexical prefix check and does not canonicalize paths, so the symlink evil/escape -> / is followed, and the file is written to the arbitrary host path (e.g., /tmp/payload.txt or ~/.bashrc).
6. Achieve code execution: The attacker's payload (e.g., a malicious shell command appended to ~/.bashrc) executes the next time the victim opens a terminal or logs in, granting the attacker code execution with the victim's privileges (GitHub Advisory).

• File System: Unexpected files written outside the Zed extension workdir (typically ~/.local/share/zed/extensions/), such as new or modified ~/.bashrc, ~/.zshrc, ~/.zprofile, ~/.config/autostart/ entries, or files in ~/.local/bin/; presence of symlinks inside the extension workdir pointing to / or other paths outside the extension directory.
• Logs: Zed application logs showing extraction of tar archives containing symlink entries; file system audit logs (e.g., auditd) recording writes to sensitive user home directory files by the Zed process.
• Process: Unexpected child processes spawned from the Zed process after extension installation; shell processes executing commands sourced from recently modified shell initialization files.
• Network: Outbound connections from the Zed process to unfamiliar or attacker-controlled hosts during or after extension installation (GitHub Advisory).

Upgrade Zed to version 0.224.4 or later, which patches the issue by rejecting or validating symlinks during tar extraction and canonicalizing paths in writeable_path_from_extension before prefix checks (GitHub Advisory). Until patching is possible, restrict installation of extensions to trusted, verified sources only, disable extension auto-updates, and monitor file system activity from Zed processes for unexpected writes outside the extension workdir. Users should audit recently installed extensions for suspicious tar contents.

The vulnerability was reported by researcher jayasuryajsk and coordinated by swannysec via GitHub's security advisory process (GitHub Advisory). The Hacker Wire published a write-up covering the sandbox escape (The Hacker Wire), and the vulnerability was discussed on Mastodon. InfinitSec also published a technical post on the issue (InfinitSec). Community reaction has been moderate given the requirement for user interaction, but the availability of a public PoC has drawn attention from security researchers.