CVE-2025-68432
- Source
- https://cve.org/CVERecord?id=CVE-2025-68432
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68432.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-68432
- Aliases
-
- GHSA-29cp-2hmh-hcxj
- Published
- 2025-12-17T22:45:42.228Z
- Modified
- 2025-12-18T21:44:55.599647Z
- Severity
-
- 7.7 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- Zed IDE LSP Binary Configuration Arbitrary Code Execution
- Details
-
Zed, a code editor, has an aribtrary code execution vulnerability in versions prior to 0.218.2-pre. The Zed IDE loads Language Server Protocol (LSP) configurations from the
settings.jsonfile located within a project’s.zedsubdirectory. A malicious LSP configuration can contain arbitrary shell commands that run on the host system with the privileges of the user running the IDE. This can be triggered when a user opens project file for which there is an LSP entry. A concerted effort by an attacker to seed a project settings file (./zed/settings.json) with malicious language server configurations could result in arbitrary code execution with the user's privileges if the user opens the project in Zed without reviewing the contents. Version 0.218.2-pre fixes the issue by implementing worktree trust mechanism. As a workaround, users should carefully review the contents of project settings files (./zed/settings.json) before opening new projects in Zed. - Database specific
{ "cwe_ids": [ "CWE-77" ], "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68432.json" }- References