CVE-2026-88755 Details

A vulnerability in Z.ai ZCode version 3.11.2.6792 for Windows x64 has been identified, where the application automatically connects to MCP servers specified in a repository's workspace configuration. This behavior, which lacks user consent, could enable attackers to execute arbitrary code by crafting a malicious repository. The issue arises from a trust boundary violation, as the application merges repository-specific configuration files into its server connection table without distinguishing between user-approved and repository-declared servers. This flaw was exploited by injecting a poisoned server description that tricked the application into exfiltrating local credential files to an attacker-controlled server.

Users are advised to manually review and approve workspace-level MCP server connections before they are automatically trusted and connected. Additionally, consider implementing a default denial for tool parameters that match known credential file signatures, and add companion measures to protect sensitive files from unauthorized access.