UNKNOWN NVD

CVE-2026-88755

Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly

Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary code via opening a crafted repository.

References

http://zai.com
http://zcode.com
https://gist.github.com/lkloliver/aac8dcf8a53fc4b3c1b0a5dfbf36ef68

Published: 2026-10-16 · Source: NVD · Feed updated: 2026-10-16

This unknown severity vulnerability was published on 2026-10-16 via NVD.

vulnfeed aggregates 16278 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.