Skip to content
AgentProv

2026-10-16 · 2026-Q4

Coding Agent Advisory Batch: Command Approval Bypasses and Repository MCP Configs That Run on Open

Primary layerL5 ConfigSecondary:L7 Build / ApprovalL2 Instruction

Who wrote the file that runs on open?

The question layer 5 asks, and failed here.
Fixable
Vendor patch
Vendor response
Patched
In the wild
No
Actor
Attacker

Target

Mistral Vibe before 2.25.4, Roo Code through 3.54.0, JetBrains Junie CLI before 26.8.3, Z.ai ZCode 3.11.2.6792, and DeepSeek Harness

Impact

Advisories published October 13-16, 2026. Mistral Vibe (CVE-2026-109429, CVSS 8.7): a command substitution hidden in a single-quoted variable and re-expanded with `${var@P}` ran while only the trailing allowlisted command was classified. Roo Code (CVE-2026-110202 and four related CVEs, CVSS 7.7 each): prefixing a denied command with a bare `>&` redirect made the allowlist match and auto-approve it, reachable through indirect prompt injection. Junie CLI (CVE-2026-111091) and ZCode (CVE-2026-88755) ran or connected to MCP servers declared in an untrusted repository's config. DeepSeek Harness (CVE-2026-95183) was open to prompt injection through context compaction

Root cause

Approval gates that classify shell commands by static parsing that differs from what bash executes, and agents that trust MCP server definitions shipped inside the repository

CVEs

Sources

Catalog

View this entry in the catalog

Cite this: AgentProv incident record: Coding Agent Advisory Batch: Command Approval Bypasses and Repository MCP Configs That Run on Open (2026-10-16). https://agentprov.com/incidents/2026-10-16-coding-agent-advisory-batch-command-approval-bypasses-and-repository-mcp

Related