hagent through commit 761eec6 OS Command Injection via Arduino and ESP32 MCP Tools
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The hagent project, through commit 761eec6, is affected, specifically its Arduino and ESP32 MCP tools. An attacker, or an AI agent manipulated through prompt injection, can send crafted input to these tools that runs arbitrary operating system commands with the privileges of the MCP server user.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagent_arduino and hagent_esp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated into arduino-cli and idf.py commands run with subprocess.run(shell=True) to execute commands as the MCP server user.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- masc-ucsc hagent
through 761eec627a1e6fb128a2a8ce9245aa595cc2f7af