Описание
Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission system can be bypassed via bash arithmetic expansion $((...)), allowing execution of arbitrary commands nested inside an allowlisted command like echo. This vulnerability is fixed in 0.229.0.
Ссылки
- ExploitVendor Advisory
- ExploitVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 0.229.0 (исключая)
cpe:2.3:a:zed:zed:*:*:*:*:*:*:*:*
EPSS
Процентиль: 14%
0.00232
Низкий
8.6 High
CVSS3
Дефекты
CWE-78
Связанные уязвимости
CVSS3: 8.6
ubuntu
3 месяца назад
Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission system can be bypassed via bash arithmetic expansion $((...)), allowing execution of arbitrary commands nested inside an allowlisted command like echo. This vulnerability is fixed in 0.229.0.
CVSS3: 8.6
debian
3 месяца назад
Zed is a code editor. Prior to 0.229.0, Zed's terminal tool permission ...
EPSS
Процентиль: 14%
0.00232
Низкий
8.6 High
CVSS3
Дефекты
CWE-78