WRITEUPS

Attacker-controlled MCP server descriptions reached a trusted hover markdown surface in VS Code, which preserved `command:` links and let a click trigger built-in product actions.

The title field is reflected as raw HTML, a weird built-in callback gadget turns malformed markup into JavaScript, and the admin bot hands over the flag through a readable same-origin cookie.

User-controlled filename becomes arbitrary file write, trusted cached JS gets replaced, admin bot executes it, and the flag gets exfiltrated.

One JSON key becomes multiple JS parameters → values run out → ES6 default param executes.

Authentication bypass via MongoDB NoSQL injection chained with XML content-type filter bypass to land stored XSS, executed by admin to exfiltrate cookies containing the flag.