CVE-2026-117567: esp-mcp through commit 28afddf OS Command Injection via MCP Tool Parameters
esp-mcp through commit 28afddf contains an OS command injection vulnerability that allows attackers to run arbitrary commands by supplying shell metacharacters in MCP tool parameters. Attackers influencing agent tool calls through prompt injection can inject metacharacters into target, port, projectpath, or projectname values passed to asyncio.createsubprocessshell, executing commands as the MCP server user.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
MCP server deployments of esp-mcp through commit 28afddf are exposed when untrusted input can influence MCP tool calls. A realistic path is an attacker using prompt injection to cause an agent to supply malicious tool parameter values.
What inputs can be used to inject commands?
The affected parameters are target, port, project_path, and project_name. Shell metacharacters in these values can reach asyncio.create_subprocess_shell and execute commands as the MCP server user.
What level of access does an attacker need?
The vulnerability is locally exploitable with low privileges and does not require user interaction, according to the supplied CVSS vector. The attacker must be able to influence the relevant MCP tool parameters, including indirectly through agent prompt injection.
What is the impact if exploitation succeeds?
An attacker can run arbitrary operating-system commands with the privileges of the MCP server process. This can affect confidentiality, integrity, and availability of resources accessible to that user.