CVE-2026-44461 affects Zed code editor versions prior to 0.227.1. The vulnerability allows arbitrary command execution on remote hosts through shell command injection in environment variable keys. When Zed builds SSH/WSL remote commands, environment variable keys are inserted without proper shell quoting or validation. Attackers who can control environment variable keys can exploit shell expansions to execute arbitrary commands on the remote host under the victim's account. The vulnerability is triggered when opening a terminal in the affected environment. This issue has been fixed in version 0.227.1.