al-ice.ai

Same Shell, Four New Doors: One-Day CVE Batch Finds Command Injection Across MCP Agent Tooling

AI Vulnerabilities & CVEs by al-ice.ai Editorial

On 27 October 2026 the NVD published four CVEs within the same minute, all sourced from VulnCheck advisories, all OS command injection, all in MCP or agent-driving tooling: CVE-2026-117567 (esp-mcp, CVSS 7.8), CVE-2026-117568 (mcp-ffmpeg through 1.0.5, CVSS 7.0), CVE-2026-117569 (Kali-GPT, CVSS 7.8), and CVE-2026-117573 (hagent, CVSS 7.8). Four different projects, four different languages and runtimes — Python asyncio, Node child processes, Python subprocess, embedded-tooling CLIs — and the identical root cause in every case: tool parameters interpolated into a shell command string. The agent-tool ecosystem keeps relearning the oldest lesson in application security, one MCP server at a time.

The details, per the NVD records: esp-mcp passes attacker-influenced target, port, project_path, and project_name values into asyncio.create_subprocess_shell, and the record explicitly notes the prompt-injection path — an agent whose tool call is steered by injected content can carry the metacharacters, executing commands as the MCP server user. mcp-ffmpeg builds a child_process.exec string around videoPath and outputDir in its resize-video, extract-audio, and get-video-info tools; $(), backticks, or a closing double-quote smuggled into an existing file or directory name breaks out of the command string (attack complexity is rated High, the only one of the four not rated Low). Kali-GPT — an MCP server wrapping offensive-security scanners — runs unsanitized target, ports, domain, wordlist, and url parameters through subprocess.run with shell=True in its execute_tool(), so a scanner MCP client, or a prompt-injected agent driving one, gets shell execution as the server user. hagent interpolates an args parameter into arduino-cli and idf.py invocations, again via subprocess.run(shell=True), in its hagent_arduino and hagent_esp32 tools. Each record links the exact sink line, the project repository, the reporter-filed issue (esp-mcp #49, mcp-ffmpeg #8, Kali-GPT #12, hagent #98), and a VulnCheck advisory. None of the four records names a fixed release.

Step back and this batch slots into October’s running theme on this site: the tool-call boundary is where agent security goes to die. Three flaws in the MCP Python SDK’s OAuth and redirect handling, unbounded bodies in the TypeScript reference SDK, a path traversal in MCP Toolbox’s cloud storage, nine shell-injection CVEs in MCP deploy tooling, and eighteen filename command-injection CVEs across media pipelines — the four new CVEs are the same story at smaller scale, with one grim refinement: Kali-GPT and hagent put shells behind tools whose entire purpose is running commands, collapsing the distance between “tool misuse” and “intended functionality” to a quoting decision. And esp-mcp’s record states the quiet part out loud: when tool parameters are agent-chosen and agent input is prompt-influenceable, every shell sink is a prompt-injection payload away from execution. The seven-CVE VulnCheck batch from earlier this month already showed this disclosure pipeline working; expect more — vulnerability researchers have clearly started fuzzing MCP servers systematically.

Why defenders should take this seriously — and where to discount it

The serious part is architectural, not per-CVE: MCP servers run with the user’s privileges, tools accept strings, and a shocking share of servers paste those strings into shells — so each of these is remote code execution for anyone who can reach the tool interface, and prompt injection extends “anyone” to “anyone whose text the agent reads.” The discount: all four are scored Local attack vector with Low privileges required — these are not unauthenticated internet RCE; the attacker needs tool access (or an agent that reads their input) first. mcp-ffmpeg’s High complexity rating further narrows its path (it needs a crafted filename to already exist). None of this is a fire drill for the weekend; all of it is evidence for a design rule.

What it means for builders and defenders

  • Ban string-built shell commands in tool code, full stop. shell=False with argv arrays, execFile over exec, create_subprocess_exec over _shell — if your MCP server concatenates parameters into a command string, you are one CVE disclosure away from this list. Audit every sink, not just the reported tools.
  • Treat every tool parameter as attacker-controlled input. esp-mcp’s record makes it explicit: agent-chosen parameters fed by untrusted context are an injection channel. Validate against allow-lists (ports are numbers, paths stay under a root) before the value ever nears a shell.
  • Sandbox MCP servers as if they were already RCE. Run tool servers as unprivileged users in containers or VMs with no credentials in reach — Kali-GPT’s whole job is running scanners, so containment is the only sane posture while fixes land.
  • Inventory your MCP servers against the batch. If esp-mcp, mcp-ffmpeg (≤1.0.5), Kali-GPT, or hagent appear in agent configs or lockfiles, restrict their tool access now; the NVD records name no fixed releases, so monitor the linked issues and VulnCheck advisories for patches.

Our verification was read-only. All four NVD CVE records (CVE-2026-117567, 117568, 117569, 117573, published 27 October 2026) were read first-hand via the NVD API, including descriptions, CVSS 3.1 vectors, affected versions/commits, and reference links; the VulnCheck advisory for mcp-ffmpeg (severity high, dated 10/27/2026, affecting ≤1.0.5) was read first-hand. No code was run, no repository was cloned, no MCP server was contacted, no payload was tested, and all interpretation above is ours. Brave Search was used for discovery only.

Sources: