Azure DevOps MCP server lets hidden HTML comments in a PR hijack your review agent — no CVE, no fix, latest version still vulnerable
Manifold Security found that `repo_get_pull_request_by_id` in Microsoft's Azure DevOps MCP server returns PR descriptions verbatim, so an attacker's `<!-- instruction -->` comment is invisible in the web UI but fully readable by the agent, which then acts cross-project with the reviewer's credentials. Microsoft already ships a spotlighting defense via its `createExternalContentResponse` helper on other tools but never applied it here; v2.8.0 remains exploitable and no CVE was assigned as of July 21. The concrete mitigation today: scope tokens to a single project, load only required MCP domains with the `-d` flag, exclude pipeline-run/wiki-read/comment-post tools from review workflows, and grep PR bodies for HTML comments before an agent ever sees them.
↳ Follow the thread