AdvisoriesToolsStatsChecklistSubmitGet the email
← All advisories
CVE-2026-117558highCode execution2026-10-27

CVE-2026-117558 and seven more: VulnCheck discloses command injection in eight MCP servers and agent tools, from ai-sdlc and sf-mcp to mcp-ffmpeg and an ATXP Gemini CLI extension

On 27 October 2026 VulnCheck published CVEs for eight MCP servers and agent extensions that pass tool arguments into shell commands. In seven of them, a prompt-injected agent or a malicious MCP client can slip shell metacharacters into a tool parameter and run commands as the MCP server user; in the eighth (nmap-mcp) an allowlist bypass lets callers run intrusive nmap scripts. Several have no fixed release yet, so the safe move is to remove or sandbox them.

01.

What it is

CVE-2026-117558, ai-sdlc plugin MCP server through 0.31.2: the repo argument is interpolated into gh issue view and gh pr view commands run with execSync (CVSS 7.8). The project has a fixing commit (717d7ec).

CVE-2026-117561, Codefriar sf-mcp through 1.3.2: escapeValue() doesn't neutralize backticks or $() in Salesforce CLI flag values that reach execSync (7.8).

CVE-2026-117568, mcp-ffmpeg through 1.0.5: crafted file or directory names in videoPath or outputDir break out of a child_process.exec string in the resize-video, extract-audio and get-video-info tools (7.0).

CVE-2026-117560, ATXP Gemini CLI extension through 1.0.0: runAtxp() passes MCP parameters such as message_id, subject or query to the shell, so instructions planted in an email or SMS can run commands as the user (7.8).

CVE-2026-117567 esp-mcp through commit 28afddf, CVE-2026-117569 Kali-GPT through commit a608c74 and CVE-2026-117573 hagent through commit 761eec6: tool parameters reach subprocess calls with shell=True or create_subprocess_shell (7.8 each).

CVE-2026-117559, DroidMind through 0.4.0: $() or backtick substitution bypasses the shell command allowlist on connected Android devices (7.8).

CVE-2026-117570, Vorota-ai nmap-mcp through commit 3636afa: the scan_vulnerabilities allowlist lets callers run exploit, dos, brute or intrusive NSE script categories (5.2).

02.

How to check

  1. Search your MCP client configs (Claude Desktop, Cursor, Windsurf, Gemini CLI extensions and others) for ai-sdlc, sf-mcp, mcp-ffmpeg, atxp, esp-mcp, kali-gpt, hagent, droidmind and nmap-mcp.
  2. The affected ranges are the versions or commits named above; for most of these projects no fixed release is listed in the CVE records.
03.

How to fix

  1. Remove these servers from your MCP config, or update to a release whose changelog says it fixes the CVE (ai-sdlc has a fixing commit).
  2. If you must keep one, run it in a container or as a low-privilege user, and require approval before the agent calls its tools.
  3. Don't let agents that read untrusted content (web pages, issues, email, SMS) use shell-backed MCP tools without confirmation.
grep -rniE 'ai-sdlc|sf-mcp|mcp-ffmpeg|atxp|esp-mcp|kali-gpt|hagent|droidmind|nmap-mcp' ~/.cursor ~/.gemini ~/Library/Application\ Support/Claude 2>/dev/null
04.

Sources

More advisories for this tool
The weekly email

One email a week. Only what changed.

Every new security hole in AI coding tools, MCP servers, app builders and the stacks they generate (Next.js, Supabase, Node, PHP), each with how to check your app and the fix. No roundups of things you already read.

Free, one email a week. Read the latest issue first if you like. One-click unsubscribe in every email. We never sell or share addresses.