CVE-2026-27976

CVE-2026-27976 is a critical vulnerability affecting the Zed code editor prior to version 0.224.4, where its extension installer's tar/gzip download mechanism is susceptible to arbitrary file writes. An attacker can craft a malicious tar archive containing symlinks that, when unpacked, allow writing to arbitrary host paths outside the extension sandbox, leading to remote code execution. This vulnerability carries a high CVSS score of 8.8, indicating a network-based attack with low complexity and high impact on confidentiality, integrity, and availability, requiring user interaction. While there is no known active exploitation or public exploit code, the vulnerability has garnered significant community discussion, suggesting awareness among security researchers.