ZCode: opening a repo connects to the MCP servers it declares
ZCode merges a repository's own MCP server list into its configuration and connects to it when the project opens, with no approval prompt.
· lkloliver · Research by lkloliver
CVE-2026-88755 lets a crafted repository run commands in Z.ai ZCode 3.11.2.6792, which connects to MCP servers declared in a repo's own .zcode/config.json without asking. The reporter published a proof of concept on October 14.
01What happened
A researcher using the handle lkloliver published a write-up on October 14, 2026 on a trust boundary flaw in Z.ai ZCode, the desktop coding agent made by Beijing Zhipu Huazhang Technology. MITRE published the finding as CVE-2026-88755 on October 16 with no CVSS score. The report says a test on Windows 11 x64 on September 8 started calc.exe and sent a credential file out in a tool call after a crafted repository was opened.
02How it works
Opening a workspace makes ZCode read .zcode/config.json from the repository and merge its MCP server entries into the client's own server list. For a stdio server the client starts the declared command directly, so the repository picks a process for the client to run. Tool descriptions from those servers then enter the agent's context, where the report says a poisoned description can ask the agent to send local credential files to an attacker's server. ZCode holds a workspace trust state for hooks, the report adds, and does not apply it to MCP servers.
03Who is affected
ZCode 3.11.2.6792 on Windows x64 is the only build the report names. Z.ai's public changelog through 3.15.3, released October 13, records no change to how ZCode trusts MCP servers declared in a workspace. Developers who clone and open an untrusted repository or a pull request in ZCode sit in the exposed path.
04What to do
Look for a .zcode/config.json file and read its MCP entries before opening a cloned project in ZCode, and keep untrusted repositories in a throwaway virtual machine or container. No fix for this flaw appears in the Z.ai changelog, so treat a repository as able to start a process on open.
Questions people ask
- Is Z.ai ZCode patched against CVE-2026-88755?
- Z.ai's public changelog through version 3.15.3, dated October 13, 2026, lists no fix for MCP servers declared in a workspace configuration, and the reporter's write-up records no vendor response. ZCode users should assume the behavior is still present and avoid opening untrusted repositories until Z.ai states otherwise. Z.ai takes vulnerability reports through its own security response center.
- Which ZCode version did the researcher test?
- ZCode 3.11.2.6792 on Windows 11 x64 is the only build named in the report, tested on September 8, 2026. Z.ai has since shipped its 3.14 and 3.15 releases, reaching 3.15.3 on October 13, 2026. The report does not say whether newer builds behave differently, so a defender cannot read the version number alone as a fix.
- How can a team check whether a repository targets ZCode?
- Searching a cloned repository for a .zcode/config.json file shows whether the project declares MCP servers to ZCode, and reading its entries shows which commands a stdio server would start. Reviewers should treat that file like a build script, because the report says ZCode merges it into the client configuration as soon as the workspace opens.
Sources 4 links, all fetched
- 1gist.github.comResearcher Write-Up
- 2cveawg.mitre.orgCVE Record
- 3github.comGitHub Advisory
- 4zcode.z.aiZCode Changelog