Search/CVE-2026-25805
● CVE — Medium

CVE-2026-25805

VendorzedProductzedDiscoveredFeb 10, 2026UpdatedFeb 19, 2026

Zed is a multiplayer code editor. Prior to 0.219.4, Zed does not show with which parameters a tool is being invoked, when asking for allowance. Further it does not show after the tool was being invoked, which parameters were used. Thus, maybe unwanted or even malicious values could be used without the user having a chance to notice it. Patched in Zed Editor 0.219.4 which includes expandable tool call details.

CVSS v3.1
6.4 MEDIUM
EPSS
0.29%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Oct 26, 2026
▲ 0.05pp
0.24% → 0.29% over 6 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityHIGH
Privileges RequiredHIGH
User InteractionREQUIRED
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Connections
2 relationships
Timeline
disclosure → media coverage
Feb 10, 2026
Disclosure — published as a CVE record. · last revised by NVD Feb 19, 2026