{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-15T06:21:25.518","vulnerabilities":[{"cve":{"id":"CVE-2026-27976","sourceIdentifier":"security-advisories@github.com","published":"2026-02-26T00:16:27.293","lastModified":"2026-03-05T16:08:38.163","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Zed, a code editor, has an extension installer allows tar/gzip downloads. Prior to version 0.224.4, the tar extractor (`async_tar::Archive::unpack`) creates symlinks from the archive without validation, and the path guard (`writeable_path_from_extension`) only performs lexical prefix checks without resolving symlinks. An attacker can ship a tar that first creates a symlink inside the extension workdir pointing outside (e.g., `escape -> /`), then writes files through the symlink, causing writes to arbitrary host paths. This escapes the extension sandbox and enables code execution. Version 0.224.4 patches the issue."},{"lang":"es","value":"Zed, un editor de código, tiene un instalador de extensiones que permite descargas tar/gzip. Antes de la versión 0.224.4, el extractor de tar ('async_tar::Archive::unpack') crea enlaces simbólicos (symlinks) desde el archivo sin validación, y el protector de rutas ('writeable_path_from_extension') solo realiza comprobaciones de prefijo léxico sin resolver enlaces simbólicos (symlinks). Un atacante puede enviar un tar que primero crea un enlace simbólico (symlink) dentro del directorio de trabajo de la extensión apuntando hacia afuera (por ejemplo, 'escape -> /'), luego escribe archivos a través del enlace simbólico (symlink), provocando escrituras en rutas de host arbitrarias. Esto escapa de la sandbox de la extensión y permite la ejecución de código. La versión 0.224.4 soluciona el problema."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-61"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:zed:zed:*:*:*:*:*:*:*:*","versionEndExcluding":"0.224.4","matchCriteriaId":"63C50DD7-F03F-4305-94DE-F5BFF201BA6A"}]}]}],"references":[{"url":"https://github.com/zed-industries/zed/security/advisories/GHSA-59p4-3mhm-qm3r","source":"security-advisories@github.com","tags":["Vendor Advisory","Exploit","Mitigation"]}]}}]}