Zed Patches a Filesystem Sandbox Escape in Extension Hosting
GitHub·medium signal
Zed 1.16.2 and 1.17.1-pre, both published 2026-08-24, raise the workspace minimum wasmtime-wasi to 36.0.14 so cap-primitives resolves to the patched 3.4.6 rather than 3.4.4, which had a trailing-slash symlink handling bug that could bypass capability filesystem confinement (GHSA-vqjp-4c8c-hfgg). The same builds disable the ask_user tool by default. Anyone embedding Wasmtime to sandbox agent-run extensions should check their own cap-primitives resolution.