esp-mcp through commit 28afddf OS Command Injection via MCP Tool Parameters
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The esp-mcp server, an MCP (Model Context Protocol) tool server for Espressif ESP development, is affected by an OS command injection flaw in how it handles tool parameters. An attacker who can influence an AI agent's tool calls, such as through prompt injection, could run arbitrary commands with the privileges of the MCP server user.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
esp-mcp through commit 28afddf contains an OS command injection vulnerability that allows attackers to run arbitrary commands by supplying shell metacharacters in MCP tool parameters. Attackers influencing agent tool calls through prompt injection can inject metacharacters into target, port, project_path, or project_name values passed to asyncio.create_subprocess_shell, executing commands as the MCP server user.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- horw esp-mcp
through 28afddf9ff41ada117bb45fd49b526d3bf89749e