Z.ai ZCode v3.11.2.6792 contains a flaw that automatically establishes connections with MCP servers specified in a repository's workspace configuration. This automatic connection logic can be abused by an attacker who opens a specially crafted repository, causing the application to execute arbitrary code within the environment. The vulnerability therefore results in remote code execution for users who allow such automatic connections.

The sole affected product is Z.ai ZCode version 3.11.2.6792. No other vendor or product variants are identified in the available data.

The CVSS score is 7.8, indicating high severity. EPSS data is not available and the issue is not listed in CISA's KEV catalog, so the public exploitation probability is unknown. However, because the flaw enables remote code execution, the risk is inherently high. Attackers would need to supply a malicious repository or otherwise influence the workspace configuration to trigger the automatic connection; the design flaw removes usual controls that would otherwise mitigate such abuse. In the absence of a publicly available exploit, the likelihood of exploitation today is uncertain, but the severity of a successful attack would be critical.