Three MCP servers let agents be tricked into running shell commands

Three open-source Model Context Protocol servers contain OS command injection flaws that let an attacker run arbitrary commands on the machine hosting the server, according to entries added to the US National Vulnerability Database on 27 October 2026. MCP is the protocol that lets AI agents call external tools. In all three cases, the NVD entries say the flaws can be reached by prompt injection, meaning hostile text that an agent reads and acts on can steer a tool call into running commands.

The first, CVE-2026-117567, affects esp-mcp through commit 28afddf. The NVD entry says attackers can supply shell metacharacters in MCP tool parameters, specifically the target, port, project_path or project_name values. Those values are passed to asyncio.create_subprocess_shell, which runs them through a shell, and the resulting commands execute as the MCP server user. The advisory credits VulnCheck and references an issue filed on the project's GitHub repository.

The second, CVE-2026-117569, affects Kali-GPT through commit a608c74. According to the NVD entry, the problem sits in the execute_tool() function in kali_gpt/tools/mcp_server.py, where unsanitised scanner parameters are passed to subprocess.run with shell=True. The entry names target, ports, domain, wordlist and url as parameters that can carry shell metacharacters. It says MCP clients, or agents that have been prompt-injected, can use them to run commands as the MCP server user.

The third, CVE-2026-117573, affects hagent through commit 761eec6. The NVD entry says the args parameter of the hagent_arduino and hagent_esp32 tools is interpolated into arduino-cli and idf.py commands that are run with subprocess.run(shell=True). Crafted args therefore execute as the MCP server user. The advisory points to two files in the repository, hagent/mcp/mcp_arduino.py and hagent/mcp/mcp_esp32.py, and to a GitHub issue opened against the project.

The three advisories share a pattern. Each project takes a value that an AI agent chooses, such as a scan target or a build path, and places it inside a string that is then handed to a shell. A shell treats characters such as semicolons and backticks as instructions rather than text, so a parameter that looks like a hostname can carry a second command along with it. Because the agent supplies the parameter, anything that can influence the agent, including text in a web page, a file or an issue tracker that the agent reads, can influence what the shell runs.

All three NVD entries describe the impact as execution of commands as the MCP server user, which is the account that launched the server rather than necessarily a privileged one. The entries do not state that any of the flaws has been exploited.

Each advisory links to a GitHub issue filed against the affected project: issue 49 for esp-mcp, issue 12 for Kali-GPT and issue 98 for hagent. The NVD entries describe the affected versions as being up to a specific commit in each repository, rather than by release number, and do not list fixed versions. VulnCheck published a corresponding advisory for each of the three projects.