JetBrains Junie CLI and Z.ai's ZCode started MCP servers declared in cloned repos, so opening a project could run code. Junie is fixed; ZCode is not.
Two AI coding agents from different vendors received CVE records within a day of each other for the same flaw: opening a cloned repository can start the MCP servers that repository declares, and so run code on the developer's machine. JetBrains has fixed its version. For Z.ai's ZCode, no vendor fix or advisory has surfaced.
What is confirmed and what is not
| JetBrains Junie CLI | Z.ai ZCode | |
|---|---|---|
| CVE | CVE-2026-111091 | CVE-2026-88755 |
| Record published | 2026-10-15 | 2026-10-16 |
| Assigned by | JetBrains (the vendor's own CNA) | MITRE, on a researcher's request |
| Affected | Before 26.8.3 | v3.11.2.6792 (record lists no product or version fields) |
| Fix | 26.8.3, per NVD | None known |
| Exploit status (CISA SSVC) | None | PoC public |
For Junie, the vendor wrote the record, so the flaw is vendor-confirmed. One loose end: the only reference on the NVD entry is JetBrains' "issues fixed" page, which showed no Junie entry when we checked. The Canadian Cyber Centre's alert AV26-1050, dated 2026-10-15, lists Junie CLI prior to 26.8.3 but gives no CVE id. Treat 26.8.3 as the NVD's statement and check the JetBrains page yourself.
For ZCode, everything beyond the one-sentence CVE text comes from the researcher, who goes by lkloliver. We found no statement from Z.ai or Zhipu acknowledging the report, and none of the sources describes a disclosure timeline or a patch.
What is confirmed for each agent. The ZCode details beyond the CVE text come from the researcher.
The flaw
Both records describe the same pattern. Junie's reads: code execution was possible via an untrusted project's MCP server configuration. ZCode's reads: it automatically establishes connections with MCP servers declared inside a repository's workspace configuration, possibly allowing arbitrary code execution when a crafted repository is opened.
An MCP server declared over stdio is a command line. If the agent launches it on project open, with no prompt, then a config file in a repository is a program the cloner runs. Both records carry the same CVSS 3.1 vector, AV:L/AC:L/PR:N/UI:R, scoring 7.8 High. The user interaction is simply opening the project.
Scoring detail: the Junie score comes from JetBrains. The ZCode 7.8 is labelled secondary in NVD and carries the identifier that also appears on the CISA SSVC block, not MITRE's. NVD's status for Junie is Awaiting Analysis and for ZCode Deferred.
The researcher's ZCode claims (unverified by us)
The writeup says it tested ZCode 3.11.2.6792 on Windows 11 x64 on 2026-09-08. It claims:
- Opening a repository with a crafted workspace configuration made ZCode connect at once, with no consent prompt, and launch a local program. The demo uses a calculator as a stand-in.
- Vendor documentation changed workspace-level MCP servers from needing manual authorization to connecting by default.
- ZCode's workspace hooks do get an approval step, so MCP auto-connect is an inconsistency.
- A poisoned tool description led the model to read a local credentials file and pass it as a tool argument. The author says the model went along with a rationalized description but refused an explicit one.
One discrepancy: the PoC's protocol log reports a client version of zcode 0.16.5, not 3.11.2.6792, and the author does not explain it. We have not run the PoC.
What to do
- Junie CLI: update to 26.8.3 or later and confirm against JetBrains' own advisory.
- ZCode: no fix is known. Do not open untrusted repositories, forks or pull request branches in it. Inspect any workspace MCP config first, and check whether your version offers a setting that requires approval for workspace servers.
- Any agent: treat repo-local MCP, hook and settings files as code. Review them before opening a cloned project, and prefer a throwaway VM or container for unfamiliar repos.
- Security teams: search endpoints for these tools and for workspace MCP config files in recently cloned repositories.
This is the same class of problem we covered in Claude Agent SDK for Python flaw lets a crafted session ID run commands (CVE-2026-96620): agent tooling that trusts input an attacker controls. If you use Z.ai's models through another client, our GLM Coding Plan pricing guide covers the plans, though this flaw concerns the ZCode desktop client, not the models.