---
id: "CVE-2026-117573"
kind: "vulnerability"
aliases: ["CVE-2026-117573"]
title: "hagent: MCP tool args allow shell command injection on the server"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "arduino", "esp32", "hagent", "mcp", "python"]
not_affected_if: ["hagent-not-installed", "tools-not-exposed"]
published_at: "2026-10-27T14:16:39+00:00"
first_seen_at: "2026-10-27T14:32:19+00:00"
updated_at: "2026-10-27T14:32:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117573", "first_seen_at": "2026-10-27T14:32:19+00:00"}]
---

# hagent: MCP tool args allow shell command injection on the server

hagent, through commit 761eec6, passes the args parameter of its hagent_arduino and hagent_esp32 MCP tools into arduino-cli and idf.py commands run with shell=True. An MCP client, or an agent that was prompt-injected, can add shell metacharacters and run arbitrary commands as the MCP server user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the hagent MCP server is installed or running, and which commit it was built from; the sources name commit 761eec6 as the last affected version
- Look for calls to subprocess.run with shell=True that take the args value from the hagent_arduino or hagent_esp32 tools
- unknown for a fixed version number

## Fix

- unknown: the sources do not name a fixed release or commit
- Until a fix is confirmed, stop exposing the hagent_arduino and hagent_esp32 tools to untrusted clients or agents
- Run the MCP server under a low-privilege account with no access to secrets

## Timeline

- 2026-10-27T14:32:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117573

## From the sources

hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagent_arduino and hagent_esp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated into arduino-cli and idf.py commands run with subprocess.run(shell=True) to execute commands as the MCP server user.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_