CVE-2026-44466 is an OS command injection vulnerability in the zed code editor before version 0.229.0. The vulnerability allows attackers to bypass the terminal tool permission system by leveraging bash arithmetic expansion syntax $((...)) within allowlisted commands, such as echo, to execute arbitrary nested commands. This improper neutralization of special elements (CWE-78) leads to potential full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is resolved in zed version 0.229.0.

Successful exploitation allows an attacker with local access and user interaction to execute arbitrary OS commands with the privileges of the user running zed. This can lead to complete compromise of the affected system's confidentiality, integrity, and availability. The CVSS score of 8.6 reflects a high impact with local attack vector, low attack complexity, no privileges required, user interaction required, and scope changed.

Upgrade zed to version 0.229.0 or later, where this vulnerability is fixed. Since the vendor advisory confirms the fix in 0.229.0, applying this official update fully mitigates the issue. No additional mitigations are indicated by the vendor.