CVE-2026-117567 esp-mcp through commit 28afddf OS Command Injection via MCP Tool Parameters
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-117567?
CVE-2026-117567 is a high-severity vulnerability in horw esp-mcp, published on 27 Oct 2026.
Official description
esp-mcp through commit 28afddf contains an OS command injection vulnerability that allows attackers to run arbitrary commands by supplying shell metacharacters in MCP tool parameters. Attackers influencing agent tool calls through prompt injection can inject metacharacters into target, port, project_path, or project_name values passed to asyncio.create_subprocess_shell, executing commands as the MCP server user.
Weakness: CWE-78
Which versions are affected by CVE-2026-117567?
How do I fix CVE-2026-117567?
No fix has been published for CVE-2026-117567 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-117567 being exploited?
There is no known exploitation of CVE-2026-117567 in the wild and no public exploit code.
Sources
Also known as GHSA-3w6w-vpcf-fv9h.