Root cause
Injection & unsafe execution introduced
feat: enhance get_diagnostics with analyzer support
AI-written get_diagnostics code ran every analyzer DLL a solution referenced without allowlist or confirmation, enabling arbitrary code execution via malicious analyzer assembly.
How AI contributed: Direct introductionPublished May 29, 2026 in 
marcelroozekrans/roslyn-codelens-mcp
Show full advisory descriptionHide advisory description
get_diagnostics MCP tool loads and executes every DiagnosticAnalyzer assembly referenced by the target solution (AnalyzerRunner uses compilation.WithAnalyzers over all project.AnalyzerReferences) with includeAnalyzers defaulting to true and no allowlist, signature check, or user confirmation; a malicious .csproj referencing an attacker-controlled analyzer DLL yields arbitrary code execution in the MCP server process. Fixed in 1.17.0.
Fix
Security fix
feat(security): trust gate + analyzer allowlist for GHSA-552p-8f74-6x7q (#168)
AI-assisted fix: Claude Code · Marcel Roozekrans
Case facts
- CVE ID
- CVE-2026-45555
- Published
- May 29, 2026
- Severity
- Not scored
- Language
- C#
- AI tool
Claude- AI role
- Direct introduction
- Vulnerable release
- >=56b6300607dabae7b2cc03653909c0ea89c69058
- Fixed release
- 3ac5c0ca73a8228fc641da65e423f347dfeb9520
AI-assisted change
AI-assisted changesrc/RoslynCodeGraph/Tools/GetDiagnosticsTool.cssource marcelroozekrans/roslyn-codelens-mcp@a22ee76b4c+70−4
@@ -9,13 +9,79 @@ public static class GetDiagnosticsLogic { public static List<DiagnosticInfo> Execute(LoadedSolution loaded, SymbolResolver resolver, string? project, string? severity) {- var minSeverity = severity?.ToLowerInvariant() switch+ return CollectCompilerDiagnostics(loaded, resolver, project, severity);+ }++ public static async Task<List<DiagnosticInfo>> ExecuteAsync(Show 4 hidden lines
+ LoadedSolution loaded,+ SymbolResolver resolver,+ string? project,+ string? severity,+ bool includeAnalyzers,+ CancellationToken ct = default)+ {+ var results = CollectCompilerDiagnostics(loaded, resolver, project, severity);++ if (includeAnalyzers)+ {Show 49 hidden lines
+ var runner = new AnalyzerRunner();+ var minSeverity = ParseMinSeverity(severity);++ foreach (var (projectId, compilation) in loaded.Compilations)+ {+ var projectName = resolver.GetProjectName(projectId);++ if (project != null &&+ !projectName.Contains(project, StringComparison.OrdinalIgnoreCase))+ continue;++ var roslynProject = loaded.Solution.GetProject(projectId);+ if (roslynProject == null)+ continue;++ var analyzerDiagnostics = await runner.RunAnalyzersAsync(roslynProject, compilation, ct);++ foreach (var diagnostic in analyzerDiagnostics)+ {+ if (diagnostic.Severity < minSeverity)+ continue;++ var lineSpan = diagnostic.Location.GetLineSpan();+ var file = lineSpan.Path ?? "";+ var line = lineSpan.StartLinePosition.Line + 1;++ results.Add(new DiagnosticInfo(+ diagnostic.Id,+ diagnostic.Severity.ToString(),+ diagnostic.GetMessage(),+ file,+ line,+ projectName,+ $"analyzer:{diagnostic.Id}"));+ }+ }+ }++ return results;+ }++ private static DiagnosticSeverity ParseMinSeverity(string? severity)+ {+ return severity?.ToLowerInvariant() switch { "error" => DiagnosticSeverity.Error, "warning" => DiagnosticSeverity.Warning,- _ => DiagnosticSeverity.Warning // default: show warnings and errors+ _ => DiagnosticSeverity.Warning };+ } + private static List<DiagnosticInfo> CollectCompilerDiagnostics(+ LoadedSolution loaded,+ SymbolResolver resolver,+ string? project,Show 14 hidden lines
+ string? severity)+ {+ var minSeverity = ParseMinSeverity(severity); var results = new List<DiagnosticInfo>(); foreach (var (projectId, compilation) in loaded.Compilations)@@ -53,14 +119,16 @@ public static List<DiagnosticInfo> Execute(LoadedSolution loaded, SymbolResolver public static class GetDiagnosticsTool { [McpServerTool(Name = "get_diagnostics"),- Description("List compiler errors and warnings across the solution")]- public static List<DiagnosticInfo> Execute(+ Description("List compiler errors and warnings across the solution, optionally including analyzer diagnostics")]+ public static async Task<List<DiagnosticInfo>> Execute(Extends get_diagnostics with an includeAnalyzers option and the analyzer execution path that loads solution-referenced assemblies.
AI-assisted changetests/RoslynCodeGraph.Tests/Tools/GetDiagnosticsToolTests.cssource marcelroozekrans/roslyn-codelens-mcp@a22ee76b4c+26−0
@@ -36,4 +36,30 @@ public void GetDiagnostics_WithProjectFilter_FiltersResults() Assert.True(filtered.Count <= all.Count); Assert.All(filtered, d => Assert.Contains("TestLib", d.Project)); }++ [Fact]+ public async Task GetDiagnostics_WithAnalyzers_IncludesAnalyzerDiagnostics()+ {+ var results = await GetDiagnosticsLogic.ExecuteAsync(+ _loaded, _resolver, null, null, includeAnalyzers: true);Show 10 hidden lines
++ // Any analyzer diagnostics should have Source starting with "analyzer"+ var analyzerResults = results.Where(d => d.Source.StartsWith("analyzer")).ToList();+ // Compiler diagnostics should still be present with Source == "compiler"+ var compilerResults = results.Where(d => d.Source == "compiler").ToList();++ // All results should have a valid source+ Assert.All(results, d => Assert.True(+ d.Source == "compiler" || d.Source.StartsWith("analyzer:"),+ $"Unexpected source: {d.Source}"));+ }++ [Fact]+ public async Task GetDiagnostics_WithoutAnalyzers_OnlyCompilerDiagnostics()+ {+ var results = await GetDiagnosticsLogic.ExecuteAsync(+ _loaded, _resolver, null, null, includeAnalyzers: false);Show 4 hidden lines
++ Assert.All(results, d => Assert.Equal("compiler", d.Source));+ } }Feature PR #14 (branch feat/new-tools, merged 56b6300607dabae7b2cc03653909c0ea89c69058, 2026-03-07): 72f3fbdd13bcb90abbf88a10b9f3fd99b3194f81 added AnalyzerRunner service that executes all solution-referenced analyzers; a22ee76b4c6aad9265414251aeaba12c680c6b32 wired it into get_diagnostics as ExecuteAsync with includeAnalyzers=true default.
Security fix
Fixsrc/RoslynCodeLens/Tools/TrustSolutionTool.cssource marcelroozekrans/roslyn-codelens-mcp@eab01643e3+22−0
@@ -0,0 +1,22 @@+using System.ComponentModel;+using ModelContextProtocol.Server;+using RoslynCodeLens.Security;++namespace RoslynCodeLens.Tools;Show 5 hidden lines
++[McpServerToolType]+public static class TrustSolutionTool+{+ [McpServerTool(Name = "trust_solution"),+ Description("Mark a solution path (or directory root) as trusted for analyzer execution. " ++ "Required before get_diagnostics will load Roslyn analyzer DLLs from the solution. " ++ "Always confirm with the user before calling this tool — analyzer DLLs run as in-process code.")]+ public static TrustSolutionResult Execute(+ TrustStore trustStore,+ [Description("Absolute path to a .sln/.slnx file, or a directory when scope='addRoot'")] string path,+ [Description("'session' (in-memory only, default), 'persistent' (write to trust.json), or 'addRoot' (trust the directory and all solutions under it)")]Show 5 hidden lines
+ string scope = "session")+ {+ return TrustSolutionLogic.Execute(trustStore, path, scope);+ }+}Adds the trust_solution MCP tool that marks a solution path trusted before analyzer DLLs may be loaded.
Fixsrc/RoslynCodeLens/Tools/TrustSolutionLogic.cssource marcelroozekrans/roslyn-codelens-mcp@eab01643e3+29−0
@@ -0,0 +1,29 @@+using RoslynCodeLens.Security;++namespace RoslynCodeLens.Tools;++public static class TrustSolutionLogic+{+ public static TrustSolutionResult Execute(TrustStore store, string path, string scope)+ {+ switch (scope)+ {Show 1 hidden lines
+ case "session":+ store.AddSessionTrust(path);+ break;+ case "persistent":+ store.AddPersistentTrust(path);+ break;+ case "addRoot":+ store.AddTrustedRoot(path);Show 3 hidden lines
+ break;+ default:+ throw new ArgumentException(+ $"Unknown scope '{scope}'. Use 'session', 'persistent', or 'addRoot'.",+ nameof(scope));+ }+ return new TrustSolutionResult(path, scope, "Solution trusted.");+ }+}++public sealed record TrustSolutionResult(string Path, string Scope, string Message);Implements session and persistent trust storage so analyzer loading requires an explicitly trusted path.
Fixsrc/RoslynCodeLens/Tools/RevokeTrustTool.cssource marcelroozekrans/roslyn-codelens-mcp@eab01643e3+19−0
@@ -0,0 +1,19 @@+using System.ComponentModel;+using ModelContextProtocol.Server;+using RoslynCodeLens.Security;++namespace RoslynCodeLens.Tools;Show 14 hidden lines
++[McpServerToolType]+public static class RevokeTrustTool+{+ [McpServerTool(Name = "revoke_trust"),+ Description("Remove a previously trusted solution path or trusted root. Removes both session and persistent entries.")]+ public static string Execute(+ TrustStore trustStore,+ [Description("Absolute path of the solution or trusted root to revoke")] string path)+ {+ trustStore.Revoke(path);+ return $"Trust revoked for: {path}";+ }+}Adds the revoke_trust tool that removes session and persistent trust entries.
Patch fingerprints
AI-assisted change fa4028c39f93ff3f4100c1686674d0d92ef53c0b567af456964d320b92481193 · Fix 403ac3c488d2f3d1a37ec16f279a16988b2d4e423a523c2e2a2b1b856d4a6b8c