CVE-2026-45555: Roslyn CodeLens MCP Server: Untrusted Roslyn Analyzer Execution via get_diagnostics Leads to Arbitrary Code Execution

Synopsis

An arbitrary code execution flaw exists in the Roslyn CodeLens MCP Server, a .NET semantic code intelligence service. The get_diagnostics tool loads and runs DiagnosticAnalyzer assemblies referenced by the opened solution with no allowlist, signature check, or user prompt, and the includeAnalyzers flag defaults to true. An attacker who convinces a victim to open a malicious project that references an attacker-controlled DLL gains code execution in the MCP server process at the server's OS privileges. A patched-image rebuild at version 1.17.0 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  AV:L means the attacker does not need network access; the malicious project must be opened locally by the victim's MCP server process.

• AuthenticationNot required

  PR:N means no prior account or credentials on the target system are required to stage the malicious .csproj and DLL.

• Victim interactionRequired

  UI:R means the victim must open or load the attacker-supplied solution in an editor or tool wired to the MCP server.

• Attack complexityDetail

  AC:L means exploitation is reliable: dropping a .csproj that references the malicious analyzer DLL is sufficient, with no race or environmental tuning.

Blast Radius

• Executes arbitrary attacker code inside the MCP server process with that process's OS privileges, typically the developer's user account.
• Reads any files, source code, secrets, and tokens accessible to the server user, including SSH keys, cloud credentials, and signing material on the workstation.
• Modifies or plants files on disk, including build outputs and source files, enabling supply-chain tampering of downstream artifacts.
• Can disrupt or hang the MCP server and any tooling that depends on it.