---
id: "CVE-2026-117569"
kind: "vulnerability"
aliases: ["CVE-2026-117569"]
title: "Kali-GPT: MCP server lets shell metacharacters in scanner parameters run commands"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "kali-gpt", "mcp", "python", "self-hosted"]
not_affected_if: ["no-mcp-server-exposed", "untrusted-clients-absent"]
published_at: "2026-10-27T14:16:39+00:00"
first_seen_at: "2026-10-27T14:32:19+00:00"
updated_at: "2026-10-27T14:32:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117569", "first_seen_at": "2026-10-27T14:32:19+00:00"}]
---

# Kali-GPT: MCP server lets shell metacharacters in scanner parameters run commands

Kali-GPT's MCP server passes scanner parameters such as target, ports, domain, wordlist and url into subprocess.run with shell=True without sanitizing them. An MCP client, or a prompt-injected agent, can embed shell metacharacters to run arbitrary commands as the MCP server user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether the project is in use: check for `kali_gpt/tools/mcp_server.py` in the deployed code
- Check the deployed commit: it is at or before `a608c74` if the vulnerable code path is present
- Unknown whether a fixed release exists; the sources do not say

## Fix

- unknown: the sources do not name a fixed version or commit
- Until a fix lands, do not expose the Kali-GPT MCP server to untrusted clients or to agents processing untrusted input
- Remove shell=True and pass arguments as a list if you maintain a fork

## Timeline

- 2026-10-27T14:32:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117569

## From the sources

Kali-GPT through commit a608c74 contains an OS command injection vulnerability in execute_tool() in kali_gpt/tools/mcp_server.py that allows MCP clients to run commands via unsanitized scanner parameters. Attackers or prompt-injected agents can embed shell metacharacters in parameters like target, ports, domain, wordlist, or url, executed via subprocess.run with shell=True as the MCP server user.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_