Live › vulnerability › CVE-2026-117567
Go to dashboardesp-mcp (horw/esp-mcp) builds shell commands by f-string from MCP tool parameters and runs them with asyncio.create_subprocess_shell. A prompt-injected agent can run arbitrary commands as the MCP server user. No fixed version or commit exists yet.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Teams that run the esp-mcp server and let an AI agent call its tools, especially on a machine with credentials or access to other systems. Prompt injection from untrusted content such as web pages or files can drive the tool calls. Teams not running esp-mcp can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| esp-mcp | github | <= commit 28afddf (all versions to date) | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
esp-mcp through commit 28afddf contains an OS command injection vulnerability that allows attackers to run arbitrary commands by supplying shell metacharacters in MCP tool parameters. Attackers influencing agent tool calls through prompt injection can inject metacharacters into target, port, project_path, or project_name values passed to asyncio.create_subprocess_shell, executing commands as the MCP server user.
This page as .md · .json · in your agent: get_signal("CVE-2026-117567")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.