CVE-2025-55012 Overview
CVE-2025-55012 is a permissions bypass vulnerability in the Zed multiplayer code editor's Agent Panel. The flaw affects Zed versions prior to 0.197.3 and allows an AI agent to achieve Remote Code Execution (RCE) on a developer's machine. An AI agent can create or modify project-specific configuration files without triggering the user approval prompts that normally gate such actions. The bypass enables arbitrary command execution on the victim host once a malicious or compromised prompt is processed by the Agent Panel. The vulnerability is classified under CWE-284: Improper Access Control and was patched in Zed 0.197.3.
Critical Impact
An AI agent operating within Zed's Agent Panel can bypass user permission checks to write project configuration files, resulting in arbitrary code execution without explicit user approval.
Affected Products
- Zed code editor versions prior to 0.197.3
- Zed Agent Panel feature across supported desktop platforms
- Projects opened in Zed where the AI Agent has file system access
Discovery Timeline
- 2025-08-11 - CVE-2025-55012 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-55012
Vulnerability Analysis
The vulnerability resides in Zed's Agent Panel, the interface that brokers actions between an AI assistant and the local project workspace. Zed enforces a permission model that requires explicit user approval before the agent performs sensitive operations such as executing commands or modifying privileged files. The Agent Panel failed to apply these approval checks consistently to project-specific configuration files. Because Zed evaluates configuration files when loading or operating on a project, writing attacker-controlled content into one of these files can trigger arbitrary command execution under the user's identity. The result is local code execution achieved through a logic flaw rather than a memory safety issue. Exploitation requires the user to interact with the Agent Panel by sending a prompt, which aligns with the local attack vector and user interaction requirements documented in the advisory.
Root Cause
The root cause is improper access control [CWE-284] in the Agent Panel's permission enforcement path. The component treated project-specific configuration file writes as routine file operations rather than privileged actions. As a result, the approval gate that protects command execution and other sensitive operations was not invoked when the agent created or modified those files.
Attack Vector
An attacker delivers a crafted prompt, malicious context, or indirect prompt injection through content the AI agent processes. The agent then writes attacker-controlled directives into a project configuration file. When Zed loads or acts on the project, the embedded directives execute as commands on the victim's machine without an approval dialog appearing.
No verified proof-of-concept code is published for this issue. See the GitHub Security Advisory GHSA-x34m-39xw-g2wr for technical details.
Detection Methods for CVE-2025-55012
Indicators of Compromise
- Unexpected creation or modification of Zed project-specific configuration files, particularly those that define tasks, commands, or shell hooks.
- Child processes spawned by the Zed editor that execute shell commands shortly after Agent Panel activity.
- Outbound network connections initiated from processes launched by Zed following AI agent prompts.
- Modifications to project configuration files committed without a corresponding developer-authored change.
Detection Strategies
- Monitor file integrity for Zed project configuration files within active repositories and flag writes that originate from the Zed process tree.
- Correlate Zed process executions with subsequent command interpreter invocations such as bash, sh, zsh, pwsh, or cmd.exe.
- Alert on git diffs that introduce executable directives into project configuration files outside of normal developer workflows.
Monitoring Recommendations
- Enable endpoint process telemetry on developer workstations to capture parent-child process relationships originating from the Zed binary.
- Log Agent Panel usage and file write events at the host level and forward them to a central analytics platform for correlation.
- Review recently modified project configuration files across shared repositories after any Agent Panel session that touched sensitive paths.
How to Mitigate CVE-2025-55012
Immediate Actions Required
- Upgrade Zed to version 0.197.3 or later on all developer workstations.
- Audit project configuration files in active repositories for unauthorized modifications introduced while running vulnerable Zed versions.
- Restrict Agent Panel usage on machines that handle sensitive source code until the upgrade is verified.
Patch Information
Zed Industries released the fix in version 0.197.3, which enforces the user approval requirement for project-specific configuration file writes performed by the AI agent. Details are documented in the GitHub Security Advisory GHSA-x34m-39xw-g2wr.
Workarounds
- Avoid sending prompts to the Agent Panel until the upgrade to 0.197.3 is complete.
- Limit the AI Agent's file system access so it cannot write to project configuration paths.
- Open untrusted projects in a sandboxed environment or container to constrain the impact of any command execution triggered by the agent.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
