CVE-2026-116118

A vulnerability was found in Z.ai Zcode up to versions 3.14.3/3.15.1 in an unknown functionality of the Sed Command Filter component. The manipulation leads to OS command injection, and remote exploitation is possible. The exploit has been publicly disclosed and may be used.

An attacker could remotely execute arbitrary system commands in the application's context, potentially leading to full host compromise and data access. The public availability of the exploit increases the risk of rapid attack.

Update Z.ai Zcode to a version newer than 3.15.1 once the vendor releases a fix, and until then restrict network access to the application. Consider disabling or tightening the Sed command filters until the patch is applied.