{"id":"CVE-2026-117573","kind":"vulnerability","aliases":["CVE-2026-117573"],"related":[],"title":"hagent: MCP tool args allow shell command injection on the server","description":"hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagent_arduino and hagent_esp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated into arduino-cli and idf.py commands run with subprocess.run(shell=True) to execute commands as the MCP server user.","summary":"hagent, through commit 761eec6, passes the args parameter of its hagent_arduino and hagent_esp32 MCP tools into arduino-cli and idf.py commands run with shell=True. An MCP client, or an agent that was prompt-injected, can add shell metacharacters and run arbitrary commands as the MCP server user.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","arduino","esp32","hagent","mcp","python"],"not_affected_if":["hagent-not-installed","tools-not-exposed"],"how_to_check":"- Check whether the hagent MCP server is installed or running, and which commit it was built from; the sources name commit 761eec6 as the last affected version\n- Look for calls to subprocess.run with shell=True that take the args value from the hagent_arduino or hagent_esp32 tools\n- unknown for a fixed version number","fix":"- unknown: the sources do not name a fixed release or commit\n- Until a fix is confirmed, stop exposing the hagent_arduino and hagent_esp32 tools to untrusted clients or agents\n- Run the MCP server under a low-privilege account with no access to secrets","status":"open","published_at":"2026-10-27T14:16:39+00:00","first_seen_at":"2026-10-27T14:32:19+00:00","triaged_at":"2026-10-27T14:32:48+00:00","updated_at":"2026-10-27T14:32:48+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-27T14:32:48Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a fixed release or commit\n- Until a fix is confirmed, stop exposing the hagent_arduino and hagent_esp32 tools to untrusted clients or agents\n- Run the MCP server under a low-privilege account with no access to secrets","reach":"unknown","title":"hagent: MCP tool args allow shell command injection on the server","impact":"high","summary":"hagent, through commit 761eec6, passes the args parameter of its hagent_arduino and hagent_esp32 MCP tools into arduino-cli and idf.py commands run with shell=True. An MCP client, or an agent that was prompt-injected, can add shell metacharacters and run arbitrary commands as the MCP server user.","category":"ai-tooling","nicknames":[],"who_cares":["mcp","hagent","arduino","esp32","python"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary shell commands as the MCP server user","analyst_note":"Confirm the fixed version or commit and whether the MCP server requires authentication; check the NVD page for the CVSS vector.","how_to_check":"- Check whether the hagent MCP server is installed or running, and which commit it was built from; the sources name commit 761eec6 as the last affected version\n- Look for calls to subprocess.run with shell=True that take the args value from the hagent_arduino or hagent_esp32 tools\n- unknown for a fixed version number","needs_analyst":true,"not_affected_if":["hagent-not-installed","tools-not-exposed"],"who_is_affected":"Teams that run the hagent MCP server, or connect an agent to it, at or before commit 761eec6. Exposure comes from any MCP client able to call the hagent_arduino or hagent_esp32 tools, including agents that read untrusted input. Teams that do not run hagent can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000677,"input_tokens":3357,"output_tokens":683,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-117573':14A,17A '-2026':13A,16A '761eec6':29B,81C 'add':66B 'agent':59B,116C 'ai':19B 'ai-tool':18B 'allow':5A,89C 'arbitrari':71B 'arduino':21B,37B,45B,106C,124C 'arduino-c':44B,123C 'arg':4A,32B,101C,120C 'attack':111C 'cli':46B,125C 'client':56B,91C 'command':7A,49B,72B,85C,95C,128C,136C 'commit':28B,80C 'contain':82C 'craft':119C 'cve':12A,15A 'esp32':22B,40B,109C 'execut':93C,135C 'hagent':1A,23B,26B,36B,39B,78C,105C,108C 'idf.py':48B,127C 'inject':8A,64B,86C,97C,115C 'interpol':121C 'mcp':2A,24B,41B,55B,75B,90C,139C 'metacharact':68B,98C 'os':84C 'paramet':33B,102C 'pass':30B 'prompt':63B,114C 'prompt-inject':62B,113C 'python':25B 'run':50B,70B,129C 'server':11A,76B,140C 'shell':6A,52B,67B,94C,132C 'subprocess.run':131C 'suppli':118C 'tool':3A,20B,42B,110C 'true':53B,133C 'user':77B,141C 'vulner':87C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the hagent MCP server, or connect an agent to it, at or before commit 761eec6. Exposure comes from any MCP client able to call the hagent_arduino or hagent_esp32 tools, including agents that read untrusted input. Teams that do not run hagent can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117573","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117573","severity":null,"published_at":"2026-10-27T14:16:39+00:00","modified_at":"2026-10-27T14:16:39+00:00","first_seen_at":"2026-10-27T14:32:19+00:00","fetched_at":"2026-10-27T14:32:19+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}