CVE-2026-25805

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25805", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-05T19:58:01.641Z", "datePublished": "2026-02-10T17:27:49.390Z", "dateUpdated": "2026-02-10T19:20:11.990Z"}, "containers": {"cna": {"title": "Zed does not show Parameter Values for MCP Tool Calls. Users cannot detect tool poisoning.", "problemTypes": [{"descriptions": [{"cweId": "CWE-356", "lang": "en", "description": "CWE-356: Product UI does not Warn User of Unsafe Actions", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/zed-industries/zed/security/advisories/GHSA-f2g4-87h6-4pxq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/zed-industries/zed/security/advisories/GHSA-f2g4-87h6-4pxq"}], "affected": [{"vendor": "zed-industries", "product": "zed", "versions": [{"version": "< 0.219.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-10T17:27:49.390Z"}, "descriptions": [{"lang": "en", "value": "Zed is a multiplayer code editor. Prior to 0.219.4, Zed does not show with which parameters a tool is being invoked, when asking for allowance. Further it does not show after the tool was being invoked, which parameters were used. Thus, maybe unwanted or even malicious values could be used without the user having a chance to notice it. Patched in Zed Editor 0.219.4 which includes expandable tool call details."}], "source": {"advisory": "GHSA-f2g4-87h6-4pxq", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-10T19:19:39.535300Z", "id": "CVE-2026-25805", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T19:20:11.990Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25805", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-10T19:19:39.535300Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T19:20:02.772Z"}}], "cna": {"title": "Zed does not show Parameter Values for MCP Tool Calls. Users cannot detect tool poisoning.", "source": {"advisory": "GHSA-f2g4-87h6-4pxq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "zed-industries", "product": "zed", "versions": [{"status": "affected", "version": "< 0.219.4"}]}], "references": [{"url": "https://github.com/zed-industries/zed/security/advisories/GHSA-f2g4-87h6-4pxq", "name": "https://github.com/zed-industries/zed/security/advisories/GHSA-f2g4-87h6-4pxq", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Zed is a multiplayer code editor. Prior to 0.219.4, Zed does not show with which parameters a tool is being invoked, when asking for allowance. Further it does not show after the tool was being invoked, which parameters were used. Thus, maybe unwanted or even malicious values could be used without the user having a chance to notice it. Patched in Zed Editor 0.219.4 which includes expandable tool call details."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-356", "description": "CWE-356: Product UI does not Warn User of Unsafe Actions"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-10T17:27:49.390Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25805", "state": "PUBLISHED", "dateUpdated": "2026-02-10T19:20:11.990Z", "dateReserved": "2026-02-05T19:58:01.641Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-10T17:27:49.390Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "zed", "vendor": "zed-industries", "versions": [{"status": "affected", "version": "< 0.219.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zed:zed:*:*:*:*:*:*:*:*", "matchCriteriaId": "097AC575-E913-4FE5-A82A-BC46101AA936", "versionEndExcluding": "0.219.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Zed is a multiplayer code editor. Prior to 0.219.4, Zed does not show with which parameters a tool is being invoked, when asking for allowance. Further it does not show after the tool was being invoked, which parameters were used. Thus, maybe unwanted or even malicious values could be used without the user having a chance to notice it. Patched in Zed Editor 0.219.4 which includes expandable tool call details."}, {"lang": "es", "value": "Zed es un editor de c\u00f3digo multijugador. Antes de la 0.219.4, Zed no muestra con qu\u00e9 par\u00e1metros se invoca una herramienta al solicitar permiso. Adem\u00e1s, no muestra qu\u00e9 par\u00e1metros se utilizaron despu\u00e9s de invocar la herramienta. Por lo tanto, valores posiblemente no deseados o incluso maliciosos podr\u00edan usarse sin que el usuario tenga la oportunidad de notarlo. Corregido en Zed Editor 0.219.4, que incluye detalles de llamada de herramienta expandibles."}], "id": "CVE-2026-25805", "lastModified": "2026-06-17T10:25:16.373", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.5, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25805", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-10T19:19:39.535300Z", "version": "2.0.3"}}]}, "published": "2026-02-10T18:16:38.200", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/zed-industries/zed/security/advisories/GHSA-f2g4-87h6-4pxq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-356"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.219.4)"}}], "product": "zed", "vendor": "zed-industries"}], "analysis": {"en": {"generated_at": "2026-04-17T20:44:35.150608+00:00", "value": {"mitigation_remediation": ["Upgrade Zed Editor to version\u00a00.219.4\u00a0or later, which adds expandable tool call details to the interface. ", "Review recent tool calls to ensure that parameters being passed match intended values; when an upgrade is not immediately possible, manually verify parameters before accepting tool requests. ", "Educate users about the vulnerability: advise them to question unexpected tool calls or unfamiliar parameter values, and to confirm that the values displayed match what they expected."], "summary": {"action": "Apply Patch", "impact": "Potential tool parameter manipulation without user visibility"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Zed code editor developed by zed\u2011industries. Any installation of Zed before version 0.219.4 is susceptible to this issue; later releases contain an expandable view of tool call details that mitigates the problem. ", "description_and_impact": "Zed Editor versions prior to 0.219.4 do not display the parameters supplied to a tool when a user is asked for permission, nor does it display them after the tool is invoked. As a result, a tool could be run with malicious or unintended values and the user would have no opportunity to detect or correct the misuse, which could compromise the integrity of the code base. This weakness is classified as CWE\u2011356, the unsafe use of information. ", "risk_and_exploitability": "The CVSS base score of 6.4 indicates moderate severity, while the EPSS score of less than 1\u00a0% suggests a very low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require the attacker to convince a user to approve a tool invocation within a collaborative session, or to embed the malicious tool call inside shared code. The user must manually inspect parameters, which is currently not possible due to the missing UI feedback. Low EPSS and the need for user interaction together imply that the real-world risk is limited, but the potential impact remains significant for developers relying on tool integration. "}}}}, "created": "2026-02-10T21:41:57.997581+00:00", "updated": "2026-04-17T20:45:25.778924+00:00", "vendors": ["zed-industries", "zed-industries$PRODUCT$zed"]}