Zed versions before 0.227.1 build SSH/WSL remote commands by concatenating environment variable keys directly into shell command strings without proper quoting or validation. This allows shell expansions such as $(...) in environment variable keys to be evaluated by the remote shell when a terminal session is opened, leading to OS command injection (CWE-78). The vulnerability enables arbitrary command execution on the remote host with the privileges of the victim user. The issue is fixed in version 0.227.1.

Successful exploitation allows an attacker who can influence environment variable keys (e.g., via project terminal settings) to execute arbitrary commands on the remote host under the victim user's account. This can lead to full compromise of the user's remote environment, including confidentiality, integrity, and availability impacts. The CVSS 3.1 score is 8.6 (high severity) reflecting local attack vector, low complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality, integrity, and availability.

Upgrade Zed to version 0.227.1 or later, where this vulnerability is fixed. There is no official patch link provided, but the vendor has addressed the issue in this version. Until upgrading, avoid using untrusted environment variable keys in remote terminal settings to reduce risk.