
Affected Vendor(s)
Affected Product(s)
Summary
The Zed IDE loads Language Server Protocol (LSP) configurations from the settings.json file located within a project’s .zed subdirectory. A malicious LSP configuration can contain arbitrary shell commands that run on the host system with the privileges of the user running the IDE. This can be triggered when a user opens project file for which there is an LSP entry.
Timeline
Credit
Blog Post
References
Take the first step towards securing your AI. Book a demo now and we'll reach out to you.
