CVE-2026-45555: Roslyn CodeLens MCP Server Arbitrary Code Execution via Malicious Diagnostic Analyzers

Technical summary

CVE-2026-45555 affects the get_diagnostics MCP tool within Roslyn CodeLens MCP Server versions 0.0.9 through 1.17.0. The vulnerability stems from unchecked loading of DiagnosticAnalyzer assemblies specified in .csproj files. The root cause is the absence of validation mechanisms—no signature verification, allowlist enforcement, or explicit user confirmation occurs before assembly execution. The includeAnalyzers parameter defaults to true, meaning malicious analyzers load automatically without requiring developer opt-in. The attack surface is the local filesystem; an attacker places a compromised .NET project containing a malicious .csproj referencing an attacker-controlled DLL in a directory the victim accesses with the MCP server. Upon loading the solution, arbitrary code execution occurs in the server's process context. This is classified as improper control of dynamically managed code objects (CWE-94).

Business impact

For development teams using Roslyn CodeLens MCP Server, compromise of the development environment can lead to supply chain attacks. An attacker executing code in the server process gains access to source code repositories, credentials stored in the development environment, build artifacts, and potentially CI/CD pipeline tokens. This could result in injection of malicious code into released software, theft of proprietary source code, or establishment of persistent backdoors in compiled binaries. Organizations relying on this tool for semantic code intelligence in large .NET codebases face heightened risk of development pipeline contamination if untrusted projects are opened.

Affected systems

Roslyn CodeLens MCP Server versions 0.0.9 through 1.17.0 are affected. Version 1.17.0 contains the fix. Any development environment running an affected version and opening .NET solutions—whether from internal sources, third-party contributions, or dependency repositories—is vulnerable if a malicious .csproj file is included in the solution tree. The vulnerability applies across all operating systems where the MCP server runs (Windows, macOS, Linux).

Exploitability

The vulnerability has moderate exploitability barriers but high impact once triggered. An attacker requires the ability to introduce a malicious .csproj file into a location where a developer will open it with the MCP server—achieved through compromised repositories, pull requests, dependency injection, or social engineering. User interaction is required: the developer must open the affected project. However, no technical sophistication is needed to craft the malicious .csproj; standard .NET tooling suffices. Once the condition is met, code execution is immediate and reliable. The default configuration (includeAnalyzers=true) eliminates any accidental protection from non-adoption.

Remediation

Upgrade Roslyn CodeLens MCP Server to version 1.17.0 or later immediately. This version includes fixes that enforce proper validation of diagnostic analyzer assemblies. Until patched, mitigate risk by restricting where the MCP server process runs (isolated development environments), carefully reviewing all .NET projects opened with the server, disabling the get_diagnostics tool if unused, or setting includeAnalyzers to false in server configuration if that option is available. Do not open untrusted or unfamiliar .NET solutions with an affected MCP server instance.

Patch guidance

Apply the upgrade to version 1.17.0 or later as soon as possible. Verify compatibility with your development environment and integration with any MCP clients or language server protocol editors. Test the patched version with representative .NET projects to ensure no regressions in diagnostic analysis functionality. Monitor vendor advisories for any follow-up guidance. Organizations should prioritize this patch for development machines and shared development infrastructure.

Detection guidance

Monitor for unexpected child processes spawned by the Roslyn CodeLens MCP Server process, particularly .NET compilation tools or PowerShell executions originating from analyzer assembly loading. Log and audit which .csproj files are opened and which diagnostic analyzers are referenced. Review recent projects added to development environments for suspicious .csproj entries referencing external or unfamiliar DLL paths. Use EDR (endpoint detection and response) tools to flag code execution from the MCP server process outside expected diagnostic analysis workflows. Inspect solution files in version control for newly introduced or modified .csproj analyzer references.

Why prioritize this

This vulnerability warrants immediate prioritization despite not yet appearing in CISA's known exploited vulnerabilities catalog. The combination of local code execution, default-enabled exploitation path (includeAnalyzers=true), and supply chain implications creates substantial risk. Development environments are prime targets for persistent compromise. The attack requires only filesystem access and social engineering, not sophisticated exploitation techniques. Organizations using Roslyn CodeLens MCP Server should treat this as critical and patch all affected instances within days, not weeks.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects high impact—confidentiality, integrity, and availability are all compromised—combined with low attack complexity and no privileges required. The local attack vector limits immediate scope but does not diminish the risk given development environment compromise enables downstream supply chain attacks. The user interaction requirement prevents wormable propagation but is easily satisfied through social engineering. The score appropriately reflects a serious vulnerability meriting urgent remediation.

Frequently asked questions