Описание
Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission system can be bypassed via bash variable expansion chaining (${var@P}), allowing arbitrary command execution under an allowlisted command prefix. This vulnerability is fixed in 0.229.0.
Ссылки
- ExploitVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 0.229.0 (исключая)
cpe:2.3:a:zed:zed:*:*:*:*:*:*:*:*
EPSS
Процентиль: 36%
0.00438
Низкий
6.4 Medium
CVSS3
8.8 High
CVSS3
Дефекты
CWE-184
Связанные уязвимости
CVSS3: 6.4
ubuntu
3 месяца назад
Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission system can be bypassed via bash variable expansion chaining (${var@P}), allowing arbitrary command execution under an allowlisted command prefix. This vulnerability is fixed in 0.229.0.
CVSS3: 6.4
debian
3 месяца назад
Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission ...
EPSS
Процентиль: 36%
0.00438
Низкий
6.4 Medium
CVSS3
8.8 High
CVSS3
Дефекты
CWE-184