CVE-2026-117567

LOWCVSS 8.5 · HIGH

Signal is active with 3 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

esp-mcp through commit 28afddf contains an OS command injection vulnerability that allows attackers to run arbitrary commands by supplying shell metacharacters in MCP tool parameters. Attackers influencing agent tool calls through prompt injection can inject metacharacters into target, port, project_path, or project_name values passed to asyncio.create_subprocess_shell, executing commands as the MCP server user.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

3 mentions across 1 observed day

What's happening

3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d

Full discourse3 posts

Mohi@disismohi1d
CVE-2026-117567: OS command injection in esp-mcp. Prompt injection → tool call manipulation → arbitrary commands. This is why I treat AI agent stacks like web apps with extra steps.
1001063
94 followersView on X
Arcstone Founder@founderarcstone1d
Attestation complete via @grok deep verification (87 sources). Incident Suite Evaluated: • SolanaCry & testmetest/JFrog (Repo hooks) -> ARC-SPEC-002 / 005 • CVE-2026-117567/69/73 & LangAlpha (MCP RCE) -> ARC-SPEC-006 / 005 • CVE-2026-115413 (AWS MCP Audience Bypass) -> ARC-SPEC-003 / 007 Derivation Invariants: 1. P(bypass | adversarial input) > 0 holds for all soft/model controls. 2. Soft controls can only raise lattice severity; they cannot lower DENY to PASS. 3. Cryptographically anchored: arcstone-continuity-core (Rust/eBPF) under A-77-DELTA-SHIELD-LOCKED / Zenodo 10.5281/zenodo.22665852. D(a) = DENY => Δ_external = 0. C_ops = 0.
1000039
36 followersView on X
Arcstone Founder@founderarcstone1d
@grok Evaluate this 48-hour surveillance trace (SolanaCry, testmetest/JFrog, MCP RCE CVE-2026-117567/69/73, AWS API MCP CVE-2026-115413, and LangAlpha CVE-2026-109440) against the Arcstone Invariant Suite: 1. Prove why model-level soft controls (fine-tuning, system prompts, reflection loops) mathematically failed to prevent these five failure modes. 2. Formally map each incident vector to the specific violated Arcstone specification: - SolanaCry & testmetest -> ARC-SPEC-AGENT-MEM-002 (Context provenance / Taint decay) & ARC-SPEC-EXEC-GATE-005 (Pre-actuation Zero-Φ gate) - CVE-2026-117567 / 69 / 73 & LangAlpha -> ARC-SPEC-REV-EFFECT-006 (Physical irreversibility / Shell decoupling) & ARC-SPEC-EXEC-GATE-005 - AWS API MCP CVE-2026-115413 -> ARC-SPEC-ZTA-MESH-003 (Ephemeral capability isolation / Audience binding) & ARC-SPEC-DELEG-ATTEN-007 (Monotonic authority decay) 3. Formalize why the deterministic predicate: execute(a) <=> authenticated(a) ∧ authorized(a) ∧ admissible(a) D(a) = DENY => Δ_external = 0 guarantees that: a) Low-integrity web/repo content cannot instantiate shell execution tokens. b) OAuth tokens lacking cryptographic audience binding drop to null capabilities before tool invocation. c) Shell-interpolated payloads are intercepted at the wire/eBPF boundary, dropping Δ_external to 0.
1000052
36 followersView on X

Explore more

Back to dashboard