CVE-2026-117573: hagent through commit 761eec6 OS Command Injection via Arduino and ESP32 MCP Tools
hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagentarduino and hagentesp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated into arduino-cli and idf.py commands run with subprocess.run(shell=True) to execute commands as the MCP server user.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An MCP client that can invoke the hagent_arduino or hagent_esp32 tools can supply crafted args values. A prompt-injected agent may also trigger exploitation if it is able to call either tool.
What access does an attacker need?
The attacker needs local, low-privileged access in the context represented by the CVSS vector, plus the ability to send arguments to one of the affected MCP tools. No user interaction is required.
What is the impact of successful exploitation?
Injected shell commands execute as the MCP server user. This can affect the confidentiality, integrity, and availability of resources accessible to that user.
How can I determine whether my deployment is affected?
Check whether hagent includes the Arduino or ESP32 MCP tool implementations through commit 761eec6 and whether clients or agents can pass values to their args parameter. The vulnerable command paths invoke arduino-cli or idf.py using subprocess.run(shell=True).