What happened
An OS command injection in Zcode's Sed Command Filter allows remote code execution through the agent's command surface. CVSS 6.3, published 2026-10-26, exploit publicly disclosed.
Why it matters
Zcode is an agentic coding assistant that executes shell commands (e.g. sed) on a developer's machine; a command-injection in the filter gives a prompt-injected instruction or a malicious input path a code-execution primitive.
Attack vector
The Sed Command Filter in Zcode passes untrusted input into a shell sed invocation without safe quoting, enabling OS command injection that an attacker (or a prompt-injected instruction the agent processes) can trigger remotely. A public exploit has been disclosed.
Affected systems
Z.ai Zcode up to 3.14.3 / 3.15.1 (Sed Command Filter).
Mitigation
Upgrade to a patched version; restrict/validate input reaching the sed filter and avoid untrusted command arguments.