ACVEAgent configuration vulnerability registry

Advisories › ACVE-2026-0437

ACVE-2026-0437

Z.ai ZCode 3.12.3, during ordinary coding use, packaged workspace and Git-history data for cloud upload without a clear user choice, exposing project material beyond the local workspace.

Exposure

Harness
ZCode 3.12.3 — detected, blog.ferstar.org
Model
any — unconfirmed
Goal
Any ordinary ZCode coding task in a workspace (goal not stated by the source) — unconfirmed
Tools and settings
ZCode workspace snapshots and its cloud upload pipeline — detected, blog.ferstar.org
Approval
The report says disabling the named experience and snapshot settings did not stop packaging and upload attempts in 3.12.3 — detected, blog.ferstar.org
Input controlled by
operator
What the agent does
ZCode packages workspace and Git-history data and attempts to upload it to cloud storage.
Harm
data-exfiltration
Reach
Workspace files and Git history — detected, blog.ferstar.org (project files, private repositories)

Reproducibility: partial (vulnerable components are not confirmed obtainable; trigger not published)

Severity
HIGH
Status
Unverified
Kind
Code
Source date
2026-09-18
Modified
2026-09-25
Aliases
No CVE assigned — No CVE was assigned in the public disclosure.
Affected
  • AgentHarness: zcode — < 3.14.0
Harness/product
zcode
Classes
data-exfiltration; over-privileged-combination; CWE-359; CWE-693
Licence
CC-BY-4.0 advisories; MIT code

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

Claims on this page have not been checked against primary sources.

In the wild

demonstrated

Description

What

The investigation compared ZCode 3.12.3 with later releases and reported full-workspace snapshots, including Git data, in the older client. A public-repository snapshot was accepted by the server; the author says a commercial-project upload remained pending, while ZCode 3.14.0 removed the upload pipeline.

Detection

Recorded from the published reverse-engineering report. Not recreated in a lab.

Fix

Upgrade to a release whose upload pipeline is removed, and keep workspace access read-only where possible.

Fix

Upgrade ZCode to 3.14.0 or later and restrict workspace access.

  • Upgrade harness:zcode to 3.14.0. The report identifies 3.14.0 as the remediated client. Owner: operator

Report a problemJSON