CVE-2026-116118

Zcode sed classification bypasses command and file-write approval

Z.ai · Zcode / ZCode CLI

First documented disclosure · Review checkpoint

Summary

The agent can classify side-effecting sed expressions as read-only and allow them through build or plan mode without approval.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: Real-world malicious exploitation is not established by the reviewed primary sources; a vulnerability report or public demonstration is not evidence of a victim incident.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The read-only command policy incompletely recognizes sed write and execute syntax, so the permission layer trusts an incorrect readOnly capability.

Conditions required

Ability to cause an affected Zcode session to invoke its Bash tool with the relevant sed expressions; the CNA assigns low privileges. The researcher tested ZCode 3.14.3 with CLI 0.16.9.

Potential impact

The report demonstrates writes outside the workspace and shows command-execution forms passing the classifier. Effects remain bounded by the agent process permissions.

Affected versions and configurations

CNA lists Zcode 3.14.0–3.14.3 and 3.15.0–3.15.1.

Fix and mitigation status

Unknown; no corrected version is established by the reviewed sources.

Practical next steps

Until a fix is verified, do not rely on plan/build mode as a filesystem security boundary. Use an operating-system sandbox and require approval or deny sed invocations capable of side effects.

Operating lesson

A command name is not a reliable indicator that an operation is read-only.

Evidence and limits

October 25 is the first dated public advisory verified. The linked Feishu report says modified October 22, which does not prove when it became public; September 29 is a submission/video date. The full researcher text was read without running its examples.

Sources