Topic

Cve 2026 111091

Coverage tagged cve 2026 111091.

Articles: 1
Desk: 1

Data graphic: Junie CLI and ZCode both started MCP servers declared in an untrusted cloned repo, so opening a project runs code as the developer CVSS 7.8 High, both CVEs . The attack path runs from git clone to open, a repo-local MCP stdio config, the agent starting the server on open, and code running as the developer. Junie CLI CVE-2026-111091 is fixed in 26.8.3; ZCode CVE-2026-88755 has no known fix.

elevatedAI Security Cve 2026 111091

Two coding agents, one mistake: Junie CLI and ZCode both ran MCP servers from untrusted repos

JetBrains Junie CLI and Z.ai's ZCode started MCP servers declared in cloned repos, so opening a project could run code. Junie is fixed; ZCode is not.

Oct 18 · 4 min