{"id":"CVE-2026-88755","published":"2026-10-16T15:17:33.537","lastModified":"2026-10-16T20:18:12.557","description":"Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-78","CWE-200","CWE-284","CWE-863"],"vendors":[],"products":[],"references":[{"url":"http://zai.com","tags":[]},{"url":"http://zcode.com","tags":[]},{"url":"https://gist.github.com/lkloliver/aac8dcf8a53fc4b3c1b0a5dfbf36ef68","tags":[]},{"url":"https://github.com/lkloliver/poc/tree/main/CVE-2026-88755","tags":[]}],"exploitRefs":[{"url":"https://gist.github.com/lkloliver/aac8dcf8a53fc4b3c1b0a5dfbf36ef68","tags":[]},{"url":"https://github.com/lkloliver/poc/tree/main/CVE-2026-88755","tags":[]}],"hasPoc":true,"ai":null}