# ZCode: opening a repo connects to the MCP servers it declares

> ZCode merges a repository's own MCP server list into its configuration and connects to it when the project opens, with no approval prompt.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** lkloliver
- **Disclosed:** 2026-10-14
- **CVE:** CVE-2026-88755
- **Affects:** Z.ai ZCode
- **Research by:** [lkloliver](https://github.com/lkloliver)
- **Primary source:** https://gist.github.com/lkloliver/aac8dcf8a53fc4b3c1b0a5dfbf36ef68
- **Page:** https://theinjection.dev/items/zcode-workspace-mcp-autotrust/

CVE-2026-88755 lets a crafted repository run commands in Z.ai ZCode 3.11.2.6792, which connects to MCP servers declared in a repo's own .zcode/config.json without asking. The reporter published a proof of concept on October 14.

## What happened

A researcher using the handle lkloliver published a write-up on October 14, 2026 on a trust boundary flaw in Z.ai ZCode, the desktop coding agent made by Beijing Zhipu Huazhang Technology. MITRE published the finding as CVE-2026-88755 on October 16 with no CVSS score. The report says a test on Windows 11 x64 on September 8 started calc.exe and sent a credential file out in a tool call after a crafted repository was opened.

## How it works

Opening a workspace makes ZCode read .zcode/config.json from the repository and merge its MCP server entries into the client's own server list. For a stdio server the client starts the declared command directly, so the repository picks a process for the client to run. Tool descriptions from those servers then enter the agent's context, where the report says a poisoned description can ask the agent to send local credential files to an attacker's server. ZCode holds a workspace trust state for hooks, the report adds, and does not apply it to MCP servers.

## Who is affected

ZCode 3.11.2.6792 on Windows x64 is the only build the report names. Z.ai's public changelog through 3.15.3, released October 13, records no change to how ZCode trusts MCP servers declared in a workspace. Developers who clone and open an untrusted repository or a pull request in ZCode sit in the exposed path.

## What to do

Look for a .zcode/config.json file and read its MCP entries before opening a cloned project in ZCode, and keep untrusted repositories in a throwaway virtual machine or container. No fix for this flaw appears in the Z.ai changelog, so treat a repository as able to start a process on open.

## Quick facts

- **Affected:** Z.ai ZCode 3.11.2.6792 on Windows x64, the build the reporter tested
- **CVE:** CVE-2026-88755, published by MITRE on 2026-10-16, no CVSS score published
- **Attack type:** Repo-declared MCP servers connected without approval, then command execution and credential theft
- **Found by:** lkloliver, independent, test dated 2026-09-08
- **Disclosed:** Write-up published 2026-10-14, CVE record published 2026-10-16
- **Status:** No fix listed in the ZCode changelog through 3.15.3 of 2026-10-13, and the report records no vendor response

## Questions

### Is Z.ai ZCode patched against CVE-2026-88755?

Z.ai's public changelog through version 3.15.3, dated October 13, 2026, lists no fix for MCP servers declared in a workspace configuration, and the reporter's write-up records no vendor response. ZCode users should assume the behavior is still present and avoid opening untrusted repositories until Z.ai states otherwise. Z.ai takes vulnerability reports through its own security response center.

### Which ZCode version did the researcher test?

ZCode 3.11.2.6792 on Windows 11 x64 is the only build named in the report, tested on September 8, 2026. Z.ai has since shipped its 3.14 and 3.15 releases, reaching 3.15.3 on October 13, 2026. The report does not say whether newer builds behave differently, so a defender cannot read the version number alone as a fix.

### How can a team check whether a repository targets ZCode?

Searching a cloned repository for a .zcode/config.json file shows whether the project declares MCP servers to ZCode, and reading its entries shows which commands a stdio server would start. Reviewers should treat that file like a build script, because the report says ZCode merges it into the client configuration as soon as the workspace opens.

## Sources

1. [Researcher Write-Up](https://gist.github.com/lkloliver/aac8dcf8a53fc4b3c1b0a5dfbf36ef68)
2. [CVE Record](https://cveawg.mitre.org/api/cve/CVE-2026-88755)
3. [GitHub Advisory](https://github.com/advisories/GHSA-2vx4-m2rp-32rx)
4. [ZCode Changelog](https://zcode.z.ai/en/changelog)