CVE-2026-25805

Zed is a multiplayer code editor. Prior to 0.219.4, Zed does not show with which parameters a tool is being invoked, when asking for allowance. Further it does not show after the tool was being invoked, which parameters were used. Thus, maybe unwanted or even malicious values could be used without the user having a chance to notice it. Patched in Zed Editor 0.219.4 which includes expandable tool call details.

Scoring

Severity

MEDIUM

CVSS base score

6.4

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

EPSS probability

0.25%

CWE

CWE-356

Published

2026-02-10

Last modified

2026-03-12

Affected products

• zed-industries zed

Weakness type

• CWE-356

Related vulnerabilities

• CVE-2026-0777 — Xmind Attachment Insufficient UI Warning Remote Code Execution Vulnerability
• CVE-2025-3839 — Epiphany: insecure external protocol invocation in epiphany
• CVE-2025-14414 — Soda PDF Desktop Word File Insufficient UI Warning Remote Code Execution Vulnerability
• CVE-2025-14415 — Soda PDF Desktop Launch Insufficient UI Warning Remote Code Execution Vulnerability
• CVE-2025-14412 — Soda PDF Desktop XLS File Insufficient UI Warning Remote Code Execution Vulnerability
• CVE-2025-14418 — pdfforge PDF Architect XLS File Insufficient UI Warning Remote Code Execution Vulnerability
• CVE-2025-14417 — pdfforge PDF Architect Launch Insufficient UI Warning Remote Code Execution Vulnerability
• CVE-2025-14416 — pdfforge PDF Architect DOC File Insufficient UI Warning Remote Code Execution Vulnerability

Markdown version · Browse all CVEs