---
id: "CVE-2026-117567"
kind: "vulnerability"
aliases: ["CVE-2026-117567"]
title: "esp-mcp: shell metacharacters in MCP tool parameters run arbitrary commands"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "esp-mcp", "fixed": [], "affected": "<= commit 28afddf (all versions to date)", "ecosystem": "github"}]
ecosystems: []
tags: ["ai-tooling", "coding-agents", "command-injection", "esp-idf", "esp-mcp", "mcp", "prompt-injection", "python", "unpatched"]
not_affected_if: ["esp-idf-tools-builtin-mcp-server", "esp-mcp-not-installed"]
published_at: "2026-10-27T14:16:39+00:00"
first_seen_at: "2026-10-27T14:32:19+00:00"
updated_at: "2026-10-27T14:34:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117567", "first_seen_at": "2026-10-27T14:32:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-27T14:34:14+00:00"}]
---

# esp-mcp: shell metacharacters in MCP tool parameters run arbitrary commands

esp-mcp (horw/esp-mcp) builds shell commands by f-string from MCP tool parameters and runs them with asyncio.create_subprocess_shell. A prompt-injected agent can run arbitrary commands as the MCP server user. No fixed version or commit exists yet.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:esp-mcp affected <= commit 28afddf (all versions to date) fixed ?

## How to check

- Run 'git -C <esp-mcp checkout> log -1' (or check your install source): every build through 28afddf, the current main, is affected. The project has no tagged releases.
- Open esp_utils.py: run_command_async calling asyncio.create_subprocess_shell. In main.py, check whether target, port, project_name, project_path, idf_path, test_path or pytest_args go into f-strings without shlex.quote. Only sdkconfig_defaults is quoted.
- Check your MCP client config for an esp-mcp entry.

## Fix

unknown: no patched commit or release as of 2026-10-27 (upstream issue #49 open). Until then remove or disable the esp-mcp server, or run it in a container/VM with no credentials and require manual approval of every tool call. A fix would apply shlex.quote to all parameters or use asyncio.create_subprocess_exec with an argument list.

## Timeline

- 2026-10-27T14:32:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117567
- 2026-10-27T14:34:14+00:00 analyst — No fix exists: 28afddf (2025-12-27) is still HEAD of horw/esp-mcp main as of 2026-10-27; maintainer issue #49 (opened 2026-10-24) is open, no release. Read main.py/esp_utils.py: run_command_async uses create_subprocess_shell with f-string interpolation. NVD page empty via web-cli. Not marked verified: only reader of issue/source, no maintainer advisory.

## Documents

- [describes] horw/esp-mcp#49: Command injection (CWE-78) via unsanitized parameters in 6 MCP tools https://github.com/horw/esp-mcp/issues/49
- [describes] esp-mcp main.py (main, at 28afddf): f-string shell commands https://github.com/horw/esp-mcp/blob/main/main.py
- [mentions] esp-mcp commit history: 28afddf is latest on main https://github.com/horw/esp-mcp/commits/main

## From the sources

esp-mcp through commit 28afddf contains an OS command injection vulnerability that allows attackers to run arbitrary commands by supplying shell metacharacters in MCP tool parameters. Attackers influencing agent tool calls through prompt injection can inject metacharacters into target, port, project_path, or project_name values passed to asyncio.create_subprocess_shell, executing commands as the MCP server user.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_