Coding Agent Advisory Batch: Command Approval Bypasses and Repository MCP Configs That Run on Open

Mistral Vibe before 2.25.4, Roo Code through 3.54.0, JetBrains Junie CLI before 26.8.3, Z.ai ZCode 3.11.2.6792, and DeepSeek Harness

Advisories published October 13-16, 2026. Mistral Vibe (CVE-2026-109429, CVSS 8.7): a command substitution hidden in a single-quoted variable and re-expanded with `${var@P}` ran while only the trailing allowlisted command was classified. Roo Code (CVE-2026-110202 and four related CVEs, CVSS 7.7 each): prefixing a denied command with a bare `>&` redirect made the allowlist match and auto-approve it, reachable through indirect prompt injection. Junie CLI (CVE-2026-111091) and ZCode (CVE-2026-88755) ran or connected to MCP servers declared in an untrusted repository's config. DeepSeek Harness (CVE-2026-95183) was open to prompt injection through context compaction

Approval gates that classify shell commands by static parsing that differs from what bash executes, and agents that trust MCP server definitions shipped inside the repository