The vulnerability in zed versions before 0.229.0 involves an incomplete filtering of disallowed inputs in the terminal tool permission system. Specifically, bash variable expansion chaining (${var@P}) can be exploited to bypass the permission checks, enabling an attacker to execute arbitrary commands despite the presence of an allowlist. This is categorized as CWE-184, which concerns insufficient input validation leading to security bypasses. The vulnerability is addressed by updating to version 0.229.0 where the input validation and permission enforcement have been corrected.

Exploitation of this vulnerability allows an attacker to bypass the terminal tool permission system and execute arbitrary commands under an allowlisted command prefix. This can lead to high confidentiality impact, low integrity impact, and low availability impact as per the CVSS vector. There are no known exploits in the wild at this time.

Users should upgrade to zed version 0.229.0 or later, where this vulnerability is fixed. Since the vulnerability is resolved in this version, applying this official fix is the recommended remediation. Patch status is confirmed by the vendor's versioning information.