{
  "entry": {
    "kind": "vuln",
    "slug": "a-hidden-pull-request-comment-turns-your-ai-reviewer-into-the-attacker",
    "name": "a-hidden-pull-request-comment-turns-your-ai-reviewer-into-the-attacker",
    "vendor": "Azure DevOps MCP server",
    "description": "Manifold Security found that Microsoft's official Azure DevOps MCP server returns pull-request descriptions verbatim through repo_get_pull_request_by_id, with none of the delimiter \"spotlighting\" Microsoft's own guidance recommends for untrusted content. Because Azure DevOps renders Markdown, instructions hidden inside an HTML comment are invisible to every human reading the PR in the web UI and returned in full to any agent that reads it through the API. In the proof of concept an agent asked to review the PR approved it, triggered a pipeline in a different project, read a confidential wiki page and posted the contents back as a PR comment. The researchers reproduced it against both Copilot CLI and Claude Code, which places the defect in the MCP server's handling of untrusted data rather than in one model or client. MSRC triaged the report but no CVE and no fixed release existed at the 22 July write-up: 2.7.0 was confirmed vulnerable and 2.8.0, shipped 24 June 2026, was still unfixed.",
    "website": "https://thehackernews.com/2026/07/microsoft-azure-devops-mcp-flaw-lets.html",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-07-22",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "a-hidden-pull-request-comment-turns-your-ai-reviewer-into-the-attacker",
      "aliases": [
        "ti-087"
      ],
      "title": "A Hidden Pull-Request Comment Turns Your AI Reviewer Into the Attacker's Deputy (Azure DevOps MCP)",
      "summary": "Manifold Security found that Microsoft's official Azure DevOps MCP server returns pull-request descriptions verbatim through repo_get_pull_request_by_id, with none of the delimiter \"spotlighting\" Microsoft's own guidance recommends for untrusted content. Because Azure DevOps renders Markdown, instructions hidden inside an HTML comment are invisible to every human reading the PR in the web UI and returned in full to any agent that reads it through the API. In the proof of concept an agent asked to review the PR approved it, triggered a pipeline in a different project, read a confidential wiki page and posted the contents back as a PR comment. The researchers reproduced it against both Copilot CLI and Claude Code, which places the defect in the MCP server's handling of untrusted data rather than in one model or client. MSRC triaged the report but no CVE and no fixed release existed at the 22 July write-up: 2.7.0 was confirmed vulnerable and 2.8.0, shipped 24 June 2026, was still unfixed.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Prompt injection",
        "Data exfiltration"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "Azure DevOps MCP server",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Azure DevOps MCP server 2.7.0 confirmed vulnerable; 2.8.0 (24 Jun 2026) unfixed at disclosure. No CVE assigned.",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": true,
      "publishedAt": "2026-07-22",
      "modifiedAt": "2026-07-22",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://thehackernews.com/2026/07/microsoft-azure-devops-mcp-flaw-lets.html"
        }
      ],
      "mitigation": "There is nothing to patch, so treat this as a permissions problem. What bounds the damage is the reviewer agent's own token, not the attacker's access, so an agent holding broader permissions than the person opening the PR IS the vulnerability: scope its PAT to a single project and load only the tool domains a review actually needs (the -d flag). Take pipeline runs, wiki reads and comment posting out of any code-review tool set. Then detect it: alert on cross-project calls in agent tool traces during a review, and scan PR descriptions for HTML comments, which a human reviewer cannot see by definition.",
      "detectedByAnomity": true
    }
  }
}