CVE-2026-117569: Kali-GPT through commit a608c74 OS Command Injection via MCP Scanner Tool Parameters
Kali-GPT through commit a608c74 contains an OS command injection vulnerability in executetool() in kaligpt/tools/mcpserver.py that allows MCP clients to run commands via unsanitized scanner parameters. Attackers or prompt-injected agents can embed shell metacharacters in parameters like target, ports, domain, wordlist, or url, executed via subprocess.run with shell=True as the MCP server user.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments running the affected Kali-GPT MCP server code through commit a608c74e99910232dd208fee99de860458672b82 are exposed when MCP clients or agents can supply scanner tool parameters.
What access does an attacker need?
The attacker needs the ability to cause an MCP client or prompt-injected agent to submit scanner parameters. No user interaction is required after parameter submission, but the attack runs with the privileges of the MCP server user.
Which inputs are dangerous?
Parameters including target, ports, domain, wordlist, and url can carry shell metacharacters. These values reach subprocess.run with shell=True without sanitization.