CVE-2026-88755

high

Description

Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository.

References

https://github.com/lkloliver/poc/tree/main/CVE-2026-88755

https://gist.github.com/lkloliver/aac8dcf8a53fc4b3c1b0a5dfbf36ef68

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102905

http://zcode.com

http://zai.com

Details

Source: Mitre, NVD

Published: 2026-10-16

Updated: 2026-10-16

Risk Information

CVSS v2

Base Score: 7.2

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 7.8

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H