Zed versions before 0.227.1 build SSH/WSL remote commands by concatenating environment variable keys into shell command strings without proper quoting or validation. This allows shell expansions embedded in environment variable keys (e.g., $(...)) to be evaluated by the remote shell, resulting in OS command injection. The vulnerability enables an attacker with the ability to influence environment variable keys, such as through project terminal settings, to execute arbitrary commands on the remote host with the privileges of the victim user. The issue is addressed in Zed version 0.227.1.

Successful exploitation allows arbitrary command execution on the remote host under the victim user's account, potentially leading to full compromise of the user's remote environment, including confidentiality, integrity, and availability impacts. The CVSS 3.1 base score is 8.6 (High), reflecting local attack vector, low attack complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality, integrity, and availability.

Upgrade Zed to version 0.227.1 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are documented. Until upgrading, avoid scenarios where untrusted users can control environment variable keys used in remote terminal settings.