Arbitrary Code Execution Vulnerability in Z.ai ZCode by Z.ai
CVE-2026-88755

7.8HIGH

Key Information:

Vendor

Z.ai

Status
ZCode
Vendor
CVE Published:
16 October 2026

What is CVE-2026-88755?

Z.ai ZCode version 3.11.2.6792 contains a vulnerability that enables automatic connections to MCP servers specified in the workspace configuration. This flaw could be exploited by attackers to execute arbitrary code by manipulating the associated repository, potentially leading to serious security breaches.

References

http://zai.com
http://zcode.com
https://gist.github.com/lkloliver/aac8dcf8a53fc4b3c1b0a5d...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.