A critical vulnerability in Roslyn CodeLens MCP Server versions 0.0.9 to 1.17.0 allows arbitrary code execution through malicious DiagnosticAnalyzer assemblies. The get_diagnostics tool loads and executes assemblies without validation, allowlist, or user confirmation. Attackers can exploit this by placing a malicious .csproj file referencing attacker-controlled DLLs in locations accessed by the MCP server. The vulnerability enables code execution with server OS privileges. The issue is fixed in version 1.17.0.