# CVE-2026-27976

## Summary

- **CVE ID:** CVE-2026-27976
- **Severity:** HIGH
- **CVSS Score:** 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- **CWE:** CWE-61
- **Published:** Feb 25, 2026
- **Last Modified:** Mar 12, 2026

## Description

Zed, a code editor, has an extension installer allows tar/gzip downloads. Prior to version 0.224.4, the tar extractor (`async_tar::Archive::unpack`) creates symlinks from the archive without validation, and the path guard (`writeable_path_from_extension`) only performs lexical prefix checks without resolving symlinks. An attacker can ship a tar that first creates a symlink inside the extension workdir pointing outside (e.g., `escape -> /`), then writes files through the symlink, causing writes to arbitrary host paths. This escapes the extension sandbox and enables code execution. Version 0.224.4 patches the issue.

## Affected Products

- zed-industries — zed (< 0.224.4)

## References

- [CNA](https://github.com/zed-industries/zed/security/advisories/GHSA-59p4-3mhm-qm3r)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.49%
- **EPSS Percentile:** 41.0

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._