{"id":"CVE-2026-117567","kind":"vulnerability","aliases":["CVE-2026-117567"],"related":[],"title":"esp-mcp: shell metacharacters in MCP tool parameters run arbitrary commands","description":"esp-mcp through commit 28afddf contains an OS command injection vulnerability that allows attackers to run arbitrary commands by supplying shell metacharacters in MCP tool parameters. Attackers influencing agent tool calls through prompt injection can inject metacharacters into target, port, project_path, or project_name values passed to asyncio.create_subprocess_shell, executing commands as the MCP server user.","summary":"esp-mcp (horw/esp-mcp) builds shell commands by f-string from MCP tool parameters and runs them with asyncio.create_subprocess_shell. A prompt-injected agent can run arbitrary commands as the MCP server user. No fixed version or commit exists yet.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"esp-mcp","fixed":[],"affected":"<= commit 28afddf (all versions to date)","ecosystem":"github"}],"ecosystems":[],"tags":["ai-tooling","coding-agents","command-injection","esp-idf","esp-mcp","mcp","prompt-injection","python","unpatched"],"not_affected_if":["esp-idf-tools-builtin-mcp-server","esp-mcp-not-installed"],"how_to_check":"- Run 'git -C <esp-mcp checkout> log -1' (or check your install source): every build through 28afddf, the current main, is affected. The project has no tagged releases.\n- Open esp_utils.py: run_command_async calling asyncio.create_subprocess_shell. In main.py, check whether target, port, project_name, project_path, idf_path, test_path or pytest_args go into f-strings without shlex.quote. Only sdkconfig_defaults is quoted.\n- Check your MCP client config for an esp-mcp entry.","fix":"unknown: no patched commit or release as of 2026-10-27 (upstream issue #49 open). Until then remove or disable the esp-mcp server, or run it in a container/VM with no credentials and require manual approval of every tool call. A fix would apply shlex.quote to all parameters or use asyncio.create_subprocess_exec with an argument list.","status":"open","published_at":"2026-10-27T14:16:39+00:00","first_seen_at":"2026-10-27T14:32:19+00:00","triaged_at":"2026-10-27T14:32:48+00:00","updated_at":"2026-10-27T14:34:14+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-27T14:32:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"esp-mcp: shell metacharacters in MCP tool parameters run arbitrary commands","impact":"high","summary":"esp-mcp, an MCP server for ESP development, passes tool parameters such as target, port, project_path and project_name into a shell command without escaping. An attacker who can steer an agent's tool calls through prompt injection can run arbitrary commands as the MCP server user.","category":"ai-tooling","nicknames":[],"who_cares":["mcp","esp-mcp","python","coding-agents"],"confidence":0.6,"needs_auth":"no","worst_case":"Commands run as the MCP server user on the host.","analyst_note":"Find a fixed esp-mcp version or commit and confirm which tool parameters are reachable from agent calls; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-117567.","how_to_check":"- Check whether the esp-mcp server is installed and what commit it runs; the advisory covers builds through commit `28afddf`\n- Look for `asyncio.create_subprocess_shell` calls fed by the `target`, `port`, `project_path` or `project_name` tool parameters","needs_analyst":true,"not_affected_if":["esp-mcp-not-installed"],"who_is_affected":"Teams that run the esp-mcp server and let an AI agent call its tools, especially on a machine with credentials or access to other systems. Prompt injection from untrusted content such as web pages or files can drive the tool calls. Teams not running esp-mcp can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000625,"input_tokens":3354,"output_tokens":579,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find a fixed esp-mcp version or commit and confirm which tool parameters are reachable from agent calls; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-117567.","search":"'-117567':15A,18A '-2026':14A,17A '28afddf':91C 'agent':27B,69B,115C 'ai':23B 'ai-tool':22B 'allow':99C 'arbitrari':11A,72B,103C 'asyncio.create':62B,135C 'attack':100C,113C 'build':47B 'call':117C 'code':26B 'coding-ag':25B 'command':12A,29B,49B,73B,95C,104C,139C 'command-inject':28B 'commit':83B,90C 'contain':92C 'cve':13A,16A 'esp':2A,20A,32B,35B,44B,87C 'esp-idf':31B 'esp-mcp':1A,19A,34B,43B,86C 'execut':138C 'exist':84B 'f':52B 'f-string':51B 'fix':80B 'horw/esp-mcp':46B 'idf':33B 'influenc':114C 'inject':30B,40B,68B,96C,120C,122C 'mcp':3A,7A,21A,36B,37B,45B,55B,76B,88C,110C,142C 'metacharact':5A,108C,123C 'name':131C 'os':94C 'paramet':9A,57B,112C 'pass':133C 'path':128C 'port':126C 'project':127C,130C 'prompt':39B,67B,119C 'prompt-inject':38B,66B 'python':41B 'run':10A,59B,71B,102C 'server':77B,143C 'shell':4A,48B,64B,107C,137C 'string':53B 'subprocess':63B,136C 'suppli':106C 'target':125C 'tool':8A,24B,56B,111C,116C 'unpatch':42B 'user':78B,144C 'valu':132C 'version':81B 'vulner':97C 'yet':85B","nicknames":[],"mitigations":[],"who_affected":"Teams that run the esp-mcp server and let an AI agent call its tools, especially on a machine with credentials or access to other systems. Prompt injection from untrusted content such as web pages or files can drive the tool calls. Teams not running esp-mcp can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117567","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117567","severity":null,"published_at":"2026-10-27T14:16:39+00:00","modified_at":"2026-10-27T14:16:39+00:00","first_seen_at":"2026-10-27T14:32:19+00:00","fetched_at":"2026-10-27T14:32:19+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-117567:878","url":null,"severity":null,"published_at":"2026-10-27T14:34:14+00:00","modified_at":"2026-10-27T14:34:14+00:00","first_seen_at":"2026-10-27T14:34:14+00:00","fetched_at":"2026-10-27T14:34:14+00:00","note":"No fix exists: 28afddf (2025-12-27) is still HEAD of horw/esp-mcp main as of 2026-10-27; maintainer issue #49 (opened 2026-10-24) is open, no release. Read main.py/esp_utils.py: run_command_async uses create_subprocess_shell with f-string interpolation. NVD page empty via web-cli. Not marked verified: only reader of issue/source, no maintainer advisory."}],"documents":[{"id":6625,"url":"https://github.com/horw/esp-mcp/issues/49","title":"horw/esp-mcp#49: Command injection (CWE-78) via unsanitized parameters in 6 MCP tools","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":6627,"url":"https://github.com/horw/esp-mcp/blob/main/main.py","title":"esp-mcp main.py (main, at 28afddf): f-string shell commands","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":6628,"url":"https://github.com/horw/esp-mcp/commits/main","title":"esp-mcp commit history: 28afddf is latest on main","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}