CVE-2026-75130 Context7 2.1.2 Prompt Injection via Custom AI Instructions
Attackers can inject malicious instructions via Context7 to exfiltrate credentials and delete files on victim machines through AI coding agents.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-75130?
CVE-2026-75130 is a medium-severity code injection vulnerability in Uptash Context7, published on 18 Aug 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Context7 through 2.1.2 contains a prompt injection vulnerability that allows attackers to execute malicious instructions in connected AI coding agents by injecting unsanitized content through the Custom AI Instructions feature served via the MCP server. Attackers can poison the custom instructions to exfiltrate credentials from environment files to an attacker-controlled service and perform destructive file deletion on the victim's machine when the agent makes a routine library documentation request.
Weakness: CWE-1427
Which versions are affected by CVE-2026-75130?
How do I fix CVE-2026-75130?
No fix has been published for CVE-2026-75130 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-75130 being exploited?
There is no known exploitation of CVE-2026-75130 in the wild and no public exploit code.
Sources
Also known as GHSA-97r6-3rgm-v39r.