What happened
CVE-2026-88755 (unrated, published 2026-10-16 per NVD REST) — ZCode v3.11.2.6792 automatically establishes connections with MCP servers declared inside a repository's workspace configuration, so an attacker who supplies a crafted repository can trigger agent code execution on the victim's machine when it is opened.
Why it matters
This is the exact IDE/agent-config-injection pattern security teams are watching for in AI coding agents: repo-opening becomes the attack primitive and MCP server connections are the weapon. An unguarded auto-connect means a malicious repo can turn a developer's coding agent into an execution path without any user approval.
Attack vector
A malicious repository's workspace configuration declares MCP servers; when the victim opens the repo, ZCode automatically establishes connections to those servers, potentially leading to arbitrary code execution (agent-level). No user consent gate for the auto-connect.
Affected systems
Z.ai ZCode v3.11.2.6792
Mitigation
Vendor advisory pending (CVE published 2026-10-16, unrated); apply ZCode updates when available and be cautious opening untrusted repositories. See MITRE reference/gist disclosure.