{"id":"CVE-2026-88755","kind":"vulnerability","aliases":["CVE-2026-88755"],"related":[],"title":"Z.ai ZCode: opening a crafted repository auto-connects to attacker MCP servers","description":"Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository.","summary":"ZCode v3.11.2.6792 automatically connects to MCP servers declared in a repository's workspace configuration without asking. A crafted repository can therefore lead an attacker to execute arbitrary code on the developer's machine when it is opened.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","claude-code","developer-workstations","mcp","zcode"],"not_affected_if":["no-untrusted-repos","other-ai-editors"],"how_to_check":"- Check the installed ZCode version in the app's About dialog or package metadata and compare it with `3.11.2.6792`\n- Review the workspace configuration files in opened repositories for MCP server declarations that were not added by your team","fix":"- Move ZCode off `3.11.2.6792` to a newer release once the vendor publishes one; the sources do not name a fixed version\n- Do not open untrusted repositories in ZCode until a fixed build is installed","status":"open","published_at":"2026-10-16T15:17:33+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:10:19+00:00","updated_at":"2026-10-25T03:10:19+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T03:10:19Z","model":"claude-haiku-5-5","output":{"fix":"- Move ZCode off `3.11.2.6792` to a newer release once the vendor publishes one; the sources do not name a fixed version\n- Do not open untrusted repositories in ZCode until a fixed build is installed","reach":"local","title":"Z.ai ZCode: opening a crafted repository auto-connects to attacker MCP servers","impact":"high","summary":"ZCode v3.11.2.6792 automatically connects to MCP servers declared in a repository's workspace configuration without asking. A crafted repository can therefore lead an attacker to execute arbitrary code on the developer's machine when it is opened.","category":"ai-tooling","nicknames":[],"who_cares":["zcode","claude-code","mcp","developer-workstations"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker code runs on the developer's machine when a crafted repository is opened","analyst_note":"Find the vendor advisory or fixed ZCode version and confirm whether a workspace trust prompt exists; NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-88755 gives no fix.","how_to_check":"- Check the installed ZCode version in the app's About dialog or package metadata and compare it with `3.11.2.6792`\n- Review the workspace configuration files in opened repositories for MCP server declarations that were not added by your team","needs_analyst":true,"not_affected_if":["other-ai-editors","no-untrusted-repos"],"who_is_affected":"Developers who run ZCode v3.11.2.6792 and open repositories they did not write or fully trust. The exposure comes from the workspace configuration in the repository, so teams that only open their own vetted repositories face less risk. Teams not using ZCode can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000651,"input_tokens":3302,"output_tokens":641,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-88755':16A,19A 'ai':21B 'ai-tool':20B 'allow':88C 'arbitrari':57B,92C 'ask':46B 'attack':11A,54B,89C 'auto':8A 'auto-connect':7A 'automat':33B,74C 'claud':24B 'claude-cod':23B 'code':25B,58B,93C 'configur':44B,86C 'connect':9A,34B,76C 'craft':5A,48B,97C 'cve':14A,17A 'declar':38B,80C 'develop':27B,61B 'developer-workst':26B 'discov':72C 'establish':75C 'execut':56B,91C 'insid':81C 'lead':52B 'machin':63B 'mcp':12A,29B,36B,78C 'open':3A,67B,95C 'possibl':87C 'repositori':6A,41B,49B,83C,98C 'server':13A,37B,79C 'therefor':51B 'tool':22B 'v3.11.2.6792':32B,70C 'via':94C 'without':45B 'workspac':43B,85C 'workstat':28B 'z.ai':1A,68C 'zcode':2A,30B,31B,69C","nicknames":[],"mitigations":[],"who_affected":"Developers who run ZCode v3.11.2.6792 and open repositories they did not write or fully trust. The exposure comes from the workspace configuration in the repository, so teams that only open their own vetted repositories face less risk. Teams not using ZCode can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T15:17:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88755","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88755","severity":null,"published_at":"2026-10-16T15:17:33+00:00","modified_at":"2026-10-16T20:18:12+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}