{"id":"CVE-2026-117569","kind":"vulnerability","aliases":["CVE-2026-117569"],"related":[],"title":"Kali-GPT: MCP server lets shell metacharacters in scanner parameters run commands","description":"Kali-GPT through commit a608c74 contains an OS command injection vulnerability in execute_tool() in kali_gpt/tools/mcp_server.py that allows MCP clients to run commands via unsanitized scanner parameters. Attackers or prompt-injected agents can embed shell metacharacters in parameters like target, ports, domain, wordlist, or url, executed via subprocess.run with shell=True as the MCP server user.","summary":"Kali-GPT's MCP server passes scanner parameters such as target, ports, domain, wordlist and url into subprocess.run with shell=True without sanitizing them. An MCP client, or a prompt-injected agent, can embed shell metacharacters to run arbitrary commands as the MCP server user.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","kali-gpt","mcp","python","self-hosted"],"not_affected_if":["no-mcp-server-exposed","untrusted-clients-absent"],"how_to_check":"- Confirm whether the project is in use: check for `kali_gpt/tools/mcp_server.py` in the deployed code\n- Check the deployed commit: it is at or before `a608c74` if the vulnerable code path is present\n- Unknown whether a fixed release exists; the sources do not say","fix":"- unknown: the sources do not name a fixed version or commit\n- Until a fix lands, do not expose the Kali-GPT MCP server to untrusted clients or to agents processing untrusted input\n- Remove shell=True and pass arguments as a list if you maintain a fork","status":"open","published_at":"2026-10-27T14:16:39+00:00","first_seen_at":"2026-10-27T14:32:19+00:00","triaged_at":"2026-10-27T14:32:48+00:00","updated_at":"2026-10-27T14:32:48+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-27T14:32:48Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a fixed version or commit\n- Until a fix lands, do not expose the Kali-GPT MCP server to untrusted clients or to agents processing untrusted input\n- Remove shell=True and pass arguments as a list if you maintain a fork","reach":"unknown","title":"Kali-GPT: MCP server lets shell metacharacters in scanner parameters run commands","impact":"high","summary":"Kali-GPT's MCP server passes scanner parameters such as target, ports, domain, wordlist and url into subprocess.run with shell=True without sanitizing them. An MCP client, or a prompt-injected agent, can embed shell metacharacters to run arbitrary commands as the MCP server user.","category":"ai-tooling","nicknames":[],"who_cares":["ai-tooling","mcp","kali-gpt","python","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary shell commands as the MCP server user.","analyst_note":"Check the NVD entry for CVSS vector, auth requirement and a fixed version; the sources give no fix or affected-version range beyond commit a608c74.","how_to_check":"- Confirm whether the project is in use: check for `kali_gpt/tools/mcp_server.py` in the deployed code\n- Check the deployed commit: it is at or before `a608c74` if the vulnerable code path is present\n- Unknown whether a fixed release exists; the sources do not say","needs_analyst":true,"not_affected_if":["no-mcp-server-exposed","untrusted-clients-absent"],"who_is_affected":"Teams that run Kali-GPT and expose its MCP server to clients or agents, especially where the agent reads content an attacker can influence. Installations where the MCP server is not reachable by untrusted parties are less exposed. The sources do not say which deployment modes are most at risk.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000684,"input_tokens":3360,"output_tokens":697,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-117569':16A,19A '-2026':15A,18A 'a608c74':83C 'agent':64B,112C 'ai':21B 'ai-tool':20B 'allow':97C 'arbitrari':71B 'attack':107C 'client':58B,99C 'command':13A,72B,87C,102C 'commit':82C 'contain':84C 'cve':14A,17A 'domain':44B,122C 'emb':66B,114C 'execut':91C,126C 'gpt':3A,25B,33B,80C 'gpt/tools/mcp_server.py':95C 'host':30B 'inject':63B,88C,111C 'kali':2A,24B,32B,79C,94C 'kali-gpt':1A,23B,31B,78C 'let':6A 'like':119C 'mcp':4A,26B,35B,57B,75B,98C,134C 'metacharact':8A,68B,116C 'os':86C 'paramet':11A,39B,106C,118C 'pass':37B 'port':43B,121C 'prompt':62B,110C 'prompt-inject':61B,109C 'python':27B 'run':12A,70B,101C 'sanit':54B 'scanner':10A,38B,105C 'self':29B 'self-host':28B 'server':5A,36B,76B,135C 'shell':7A,51B,67B,115C,130C 'subprocess.run':49B,128C 'target':42B,120C 'tool':22B,92C 'true':52B,131C 'unsanit':104C 'url':47B,125C 'user':77B,136C 'via':103C,127C 'vulner':89C 'without':53B 'wordlist':45B,123C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Kali-GPT and expose its MCP server to clients or agents, especially where the agent reads content an attacker can influence. Installations where the MCP server is not reachable by untrusted parties are less exposed. The sources do not say which deployment modes are most at risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117569","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117569","severity":null,"published_at":"2026-10-27T14:16:39+00:00","modified_at":"2026-10-27T14:16:39+00:00","first_seen_at":"2026-10-27T14:32:19+00:00","fetched_at":"2026-10-27T14:32:19+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}