CVE-2026-117567 in esp-mcp
Summary
by MITRE • 10/27/2026
esp-mcp through commit 28afddf contains an OS command injection vulnerability that allows attackers to run arbitrary commands by supplying shell metacharacters in MCP tool parameters. Attackers influencing agent tool calls through prompt injection can inject metacharacters into target, port, project_path, or project_name values passed to asyncio.create_subprocess_shell, executing commands as the MCP server user.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified within esp-mcp prior to commit 28afddf represents a critical OS command injection flaw rooted in improper input validation and unsafe execution of system processes. This security defect allows remote attackers or malicious actors who have gained influence over agent tool calls via prompt injection techniques to execute arbitrary operating system commands on the host machine running the MCP server. The core technical failure lies in how user-supplied parameters are handled when passed to the asyncio.create_subprocess_shell function, which inherently interprets shell metacharacters as part of a command string rather than literal data values.
The operational mechanism of this vulnerability involves attackers manipulating specific input fields such as target, port, project_path, or project_name within MCP tool calls. By injecting shell metacharacters like semicolons, pipes, ampersands, or backticks into these parameters, an attacker can break out of the intended command context and append additional malicious commands to be executed by the underlying operating system shell. Because asyncio.create_subprocess_shell invokes a subshell to interpret the provided string, it does not treat arguments as distinct entities but rather parses them for shell syntax, thereby enabling complex command chaining that bypasses any simple sanitization measures if they are present.
The impact of this vulnerability is severe, potentially leading to full system compromise depending on the privileges under which the MCP server process operates. If the service runs with elevated permissions or access to sensitive directories, an attacker could exfiltrate data, install backdoors, pivot to other systems within the network, or disrupt services by terminating critical processes. This aligns closely with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection, where untrusted input is directly concatenated into a command without adequate sanitization or parameterization.
From a threat modeling perspective utilizing MITRE ATT&CK frameworks, this vulnerability facilitates the T1059 Execution subcategory specifically under mechanisms such as Command and Scripting Interpreter. Attackers leveraging prompt injection to achieve this code execution represent an advanced persistent threat vector where initial access is gained through social engineering or LLM manipulation rather than traditional network exploitation techniques. This highlights a growing intersection between application security vulnerabilities in AI-driven systems and classic software defense failures.
Mitigation strategies must focus on eliminating the use of shell interpretation for executing external processes whenever possible. Developers should replace asyncio.create_subprocess_shell with asyncio.create_subprocess_exec, which executes programs directly without invoking an intermediate shell, thereby preventing metacharacter interpretation entirely. If shell execution is strictly necessary due to specific feature requirements, inputs must be rigorously validated against a strict allowlist of expected characters and formats before being passed to any system call. Additionally implementing robust input sanitization that strips or escapes special shell characters can provide defense in depth but should not be relied upon as the sole control given the complexity of edge cases in string parsing.
Regular security audits focusing on how external inputs flow into subprocess calls are essential for maintaining secure AI agent architectures. Organizations deploying esp-mcp and similar tools must ensure their CI/CD pipelines include static analysis checks that flag unsafe usage patterns involving shell execution functions. Updating to versions released after commit 28afddf is the immediate remediation step, as this patch addresses the underlying code path allowing metacharacter injection within tool parameters. Continuous monitoring for anomalous process executions originating from MCP services can also aid in detecting exploitation attempts in real-time environments where patches may not yet be applied.