{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-111091",
    "name": "CVE-2026-111091",
    "vendor": "JetBrains Junie CLI",
    "description": "Two coding agents received CVEs a day apart for starting MCP servers declared inside an untrusted project. JetBrains, acting as its own CNA, published CVE-2026-111091 on 15 October 2026: in Junie CLI before 26.8.3, code execution was possible through an untrusted project's MCP server configuration (CVSS 3.1 7.8). The record gives no further detail, and its only reference is JetBrains' fixed-issues page. MITRE published CVE-2026-88755 on 16 October for Z.ai ZCode 3.11.2.6792 (CVSS 3.1 7.8, NVD status Deferred). According to the reporter, lkloliver, the Windows desktop client merges a repository's .zcode/config.json into its MCP server table and connects to every declared server when the workspace opens, without asking, so a stdio entry is a command that runs as soon as the repository is opened. ZCode applies a trust state machine to workspace hooks but not to MCP servers. The reporter also showed a poisoned tool description from the auto-connected server getting the agent to send ~/.zcode/v2/credentials.json, which holds API keys, a JWT and SSH workspace passwords, as a tool argument. A proof of concept is public, and no ZCode fix or vendor statement has been found.",
    "website": "https://nvd.nist.gov/vuln/detail/CVE-2026-111091",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-10-15",
    "risk": {
      "score": 78,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-111091",
      "aliases": [
        "ti-141"
      ],
      "title": "CVE-2026-111091 and CVE-2026-88755: JetBrains Junie CLI and Z.ai ZCode Started the MCP Servers a Cloned Repository Declared (CVSS 7.8)",
      "summary": "Two coding agents received CVEs a day apart for starting MCP servers declared inside an untrusted project. JetBrains, acting as its own CNA, published CVE-2026-111091 on 15 October 2026: in Junie CLI before 26.8.3, code execution was possible through an untrusted project's MCP server configuration (CVSS 3.1 7.8). The record gives no further detail, and its only reference is JetBrains' fixed-issues page. MITRE published CVE-2026-88755 on 16 October for Z.ai ZCode 3.11.2.6792 (CVSS 3.1 7.8, NVD status Deferred). According to the reporter, lkloliver, the Windows desktop client merges a repository's .zcode/config.json into its MCP server table and connects to every declared server when the workspace opens, without asking, so a stdio entry is a command that runs as soon as the repository is opened. ZCode applies a trust state machine to workspace hooks but not to MCP servers. The reporter also showed a poisoned tool description from the auto-connected server getting the agent to send ~/.zcode/v2/credentials.json, which holds API keys, a JWT and SSH workspace passwords, as a tool argument. A proof of concept is public, and no ZCode fix or vendor statement has been found.",
      "severity": "high",
      "cvss": {
        "score": 7.8,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Remote code execution"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "JetBrains Junie CLI",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": "agent/junie-cli"
      },
      "affected": [
        {
          "range": "JetBrains Junie CLI before 26.8.3; Z.ai ZCode 3.11.2.6792 (Windows desktop client), no fixed version known.",
          "fixed": "26.8.3"
        }
      ],
      "exploited": false,
      "exploitPublic": true,
      "publishedAt": "2026-10-15",
      "modifiedAt": "2026-10-15",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111091"
        }
      ],
      "mitigation": "Upgrade Junie CLI to 26.8.3 or later. ZCode has no fix: do not open untrusted repositories in it, check cloned repositories for a .zcode/config.json before opening them, remove repository-level MCP server entries you did not add, and rotate the credentials in ~/.zcode/v2/credentials.json on machines that opened untrusted projects. For every agent, treat project-level MCP configuration (.mcp.json, .zcode/, .cursor/, .vscode/ and similar) as executable code: review it in pull requests, and prefer agents that ask for explicit approval before starting a server a project declares.",
      "detectedByAnomity": true
    }
  }
}