CVE-2026-117569 in Kali-GPT
Summary
by MITRE • 10/27/2026
Kali-GPT through commit a608c74 contains an OS command injection vulnerability in execute_tool() in kali_gpt/tools/mcp_server.py that allows MCP clients to run commands via unsanitized scanner parameters. Attackers or prompt-injected agents can embed shell metacharacters in parameters like target, ports, domain, wordlist, or url, executed via subprocess.run with shell=True as the MCP server user.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in Kali-GPT represents a critical OS command injection flaw located within the execute_tool function of the kali_gpt/tools/mcp_server.py module. This security defect arises from the improper handling of input parameters passed by Model Context Protocol clients, specifically when these inputs are forwarded to system-level commands without adequate sanitization or validation. The core technical issue stems from the use of subprocess.run with shell=True, which instructs Python to execute the command string through a shell interpreter such as /bin/sh. When combined with unsanitized user-supplied parameters like target addresses, port lists, domain names, wordlists, or URLs, this configuration allows an attacker to inject arbitrary shell metacharacters into the execution context.
In practice, an adversary can exploit this flaw by crafting a malicious prompt that embeds shell commands within standard scanner arguments. For instance, if the tool accepts a target parameter for network scanning, an attacker could supply a value such as 192.168.1.1; cat /etc/passwd instead of a legitimate IP address. Because the subprocess execution utilizes shell=True, the semicolon acts as a command separator, causing the system to execute both the intended scan and the injected malicious command sequentially under the privileges of the MCP server user account. This mechanism effectively bypasses any application-level restrictions on what commands can be run, granting the attacker direct access to the underlying operating system environment where the service is running.
The operational impact of this vulnerability is severe, as it leads to a complete compromise of host integrity and confidentiality depending on the execution context. If the MCP server runs with elevated privileges or administrative rights, an attacker could potentially install backdoors, exfiltrate sensitive data, modify system configurations, or pivot into other network segments accessible from that machine. Even if running under a restricted user account, the ability to execute arbitrary commands can lead to significant disruption of services, denial of service conditions through resource exhaustion, or lateral movement within the local environment by leveraging available tools and scripts present on the host system. This type of attack aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection, where input validation failures allow external control over command execution flow.
From a threat modeling perspective, this vulnerability facilitates techniques associated with ATT&CK T1059 Command and Scripting Interpreter, specifically allowing attackers to leverage system utilities for unauthorized actions. It also relates to ATT&CK T1620 Reflective Code Loading if the injected commands involve dynamic loading of libraries or scripts, although in this specific case it is primarily direct command execution via shell injection. The risk is exacerbated by the nature of AI-driven tools which often accept complex natural language inputs that may be processed into structured parameters without rigorous security checks at every transformation stage. Prompt-injected agents acting as MCP clients can automate the discovery and exploitation of this flaw, making remote code execution accessible to less sophisticated adversaries who might otherwise lack direct shell access.
Mitigation strategies must focus on eliminating the use of shell=True in subprocess calls whenever possible. The recommended approach is to pass commands and their arguments as a list to subprocess.run, which bypasses the shell interpreter entirely and prevents metacharacter interpretation by the OS command line processor. For example, instead of passing a single string containing spaces or special characters, the tool should parse inputs into distinct argument lists that are passed directly to executable binaries. Additionally, implementing strict input validation using allowlists for expected parameter formats can further reduce risk. Input sanitization routines should strip or escape any non-alphanumeric characters except those strictly required by the specific utility being invoked. Regular security audits of AI-integrated tools and enforcing principle of least privilege for service accounts are also essential to limit the blast radius in case a vulnerability is discovered before patching occurs.