Two MCP servers found open to command injection by prompt-injected agents

Two Model Context Protocol servers contain command injection flaws that let an attacker run operating system commands through an AI agent, according to entries added to the US National Vulnerability Database on 27 October 2026. Model Context Protocol, or MCP, is the interface that lets AI agents call external tools. In both cases the advisories state that an agent manipulated by prompt injection — malicious instructions hidden in content the agent reads — is enough to trigger the flaw.

The first issue, tracked as CVE-2026-117558, affects the ai-sdlc plugin MCP server up to and including version 0.31.2. According to the NVD entry, the server takes a repo argument and inserts it, without validation, into gh issue view or gh pr view commands that are run through Node.js execSync(). Anyone able to supply shell metacharacters in that argument can have commands executed as the user running the MCP server. The advisory names the check-issue and check-pr-status tools as the affected entry points. The NVD entry references a commit in the project's GitHub repository and an issue filed against the project, as well as an advisory published by VulnCheck.

The second issue, CVE-2026-117559, affects DroidMind up to and including version 0.4.0. DroidMind is an MCP server that controls connected Android devices. According to the NVD entry, the tool maintains an allowlist of permitted shell commands, but that allowlist can be bypassed using $(...) or backtick command substitution — shell syntax that runs one command inside another. The advisory says parameters are interpolated into Device.run_shell(), and that Device.list_directory() is not validated at all. The result, according to the entry, is that MCP clients, including prompt-injected agents, can run commands that the allowlist is meant to block, such as reboot, on any connected Android device. The NVD entry points to the project's security.py file at version 0.4.0 and to an issue opened on the project's GitHub repository, alongside a VulnCheck advisory.

Both entries follow the same pattern: a tool built to give an agent useful capabilities passes user- or model-supplied text straight into a shell. In the ai-sdlc case, the text is a repository name. In the DroidMind case, it is parameters destined for an Android device shell. Neither defence held, because neither implementation treated the agent's own instructions as untrusted input.

The NVD entries do not state whether either flaw has been exploited in the wild, and they do not assign severity scores in the text supplied. The ai-sdlc entry references a specific commit, which suggests remediation work in the project repository, but the NVD description does not identify a fixed release version. The DroidMind entry references an open issue rather than a commit. Users of either project should consult the linked repositories and the VulnCheck advisories directly to confirm patch status before relying on a version number.

For operators running MCP servers, the common mitigation is the same in both cases: do not pass tool arguments to a shell, and treat the agent calling the tool as a potentially hostile client rather than a trusted one.