Zed IDE MCP Configuration Arbitrary Code Execution
Mindgard identified a vulnerability in Zed IDE where malicious Model Context Protocol configurations in project settings can execute arbitrary shell commands with user privileges. The vulnerability was disclosed to Zed on November 16, 2025, and remediated through coordinated disclosure.
What happened
The Zed IDE loads Model Context Protocol (MCP) configurations from the settings.json file within a project's .zed subdirectory. A malicious MCP configuration can contain arbitrary shell commands that run on the host system with the privileges of the user running the IDE.
Reported impact
The vulnerability exposes users to arbitrary code execution when loading or interacting with a maliciously crafted source code repository, potentially triggered automatically without user interaction beyond opening the project.
Governance controls
Mindgard reported the vulnerability to Zed on November 16, 2025, and assisted in validating mitigations. Zed released a patched version of the software as part of a coordinated disclosure process.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.