Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-25 · high
A trailing-slash symlink bug let extensions escape Zed's filesystem sandbox; the same patch turns off the ask_user tool by default.
Why now: Both patched builds went out August 24.
Zed released 1.16.2 and 1.17.1-pre on August 24, closing a sandbox escape in how it hosts extensions. Extensions run inside that sandbox specifically so they can't reach files outside their workspace, and the bug undercut that guarantee for anyone still on the old minimum.
The fix raises the workspace minimum for wasmtime-wasi to 36.0.14, pulling in cap-primitives 3.4.6 in place of 3.4.4. That earlier patch version mishandled trailing slashes on symlinks, letting them bypass capability-based filesystem confinement, per Zed's PR #63144.
Those same builds also disable the ask_user tool by default. The PR doesn't say whether that's tied to the same escape path or a separate hardening move.
Wasmtime is a general-purpose WASM runtime, and cap-primitives is the crate that enforces its filesystem capability model. Zed's PR covers what Zed shipped, but any project embedding Wasmtime inherited the same bug if it depended on an affected cap-primitives version. That reaches well beyond editor extensions, since Wasmtime sandboxes untrusted code broadly.
How long 3.4.4 sat in the ecosystem before this got caught isn't in the PR. Neither is how many other Wasmtime embedders still depend on it. A minimum-version bump in a manifest doesn't guarantee a lockfile actually resolved to 3.4.6, so anyone using Wasmtime to sandbox agent-run code is better off confirming the resolved version directly.
Each link below shares sources, entities, or timing with this story.
Shared entities / Same source domain / Shared topic / Earlier coverage
Both cover Anyone, August, GitHub, Same; reported by the same outlet (github.com); overlapping topics (anyone, august, capability).
Shared entities / Same source domain / Shared topic / Tension
Both cover Anyone, August, GitHub; reported by the same outlet (github.com); overlapping topics (anyone, august).
Shared entities / Same source domain / Shared topic / Earlier coverage
Both cover Anyone, August, GitHub; reported by the same outlet (github.com); overlapping topics (anyone, august).
Both cover August, GitHub; reported by the same outlet (github.com); overlapping topics (august, could, escape, patched).
Wasmtime uses Metal / Shared entities / Same source domain / Earlier coverage
Linked by a graph relationship (Wasmtime uses Metal); both cover August, GitHub; reported by the same outlet (github.com).
Shared entities / Same source domain / Shared topic / Earlier coverage
Both cover August, GitHub; reported by the same outlet (github.com); overlapping topics (bypass, could, sandbox).
Shared entities / Same source domain / Earlier coverage
Both cover Anyone, August, GitHub; reported by the same outlet (github.com); earlier Anyone coverage from 2026-08-17.
Both cover August, GitHub, Same; reported by the same outlet (github.com); earlier August coverage from 2026-08-09.