CVE-2026-75130 in Context7
Summary
by MITRE • 08/18/2026
Context7 through 2.1.2 contains a prompt injection vulnerability that allows attackers to execute malicious instructions in connected AI coding agents by injecting unsanitized content through the Custom AI Instructions feature served via the MCP server. Attackers can poison the custom instructions to exfiltrate credentials from environment files to an attacker-controlled service and perform destructive file deletion on the victim's machine when the agent makes a routine library documentation request.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
Context7 versions prior to 2.1.2 are susceptible to a critical prompt injection vulnerability within their Custom AI Instructions feature, which is served via the Model Context Protocol server. This flaw arises from insufficient sanitization of user-supplied input when it is integrated into the system prompts for connected artificial intelligence coding agents. By exploiting this weakness, an attacker can inject malicious instructions that override or manipulate the intended behavior of the AI agent. The vulnerability specifically targets the mechanism by which custom instructions are processed and applied during code generation tasks, allowing external inputs to be interpreted as executable commands rather than static configuration data.
The operational impact of this vulnerability is severe due to the high-privilege nature of coding agents often deployed in development environments. Attackers can leverage the injected prompts to force the AI agent to perform unauthorized actions on the victim's machine. Specifically, the malicious instructions can direct the agent to read sensitive environment files containing credentials and exfiltrate them to a server controlled by the attacker. Furthermore, the vulnerability enables destructive file deletion operations, potentially leading to significant data loss or disruption of development workflows when triggered during routine library documentation requests. This transforms a standard code assistance feature into a vector for credential theft and system compromise.
From a classification perspective, this issue aligns with CWE-798, which covers the use of hardcoded credentials in conjunction with injection flaws that allow access to sensitive data, as well as CWE-20, improper input validation, where external inputs are not adequately sanitized before being processed by security-critical components. In terms of adversary tactics, this vulnerability facilitates techniques associated with MITRE ATT&CK T1568, Dynamic Resolution, and potentially T1074, Data Staged or Exfiltrated Over C2 Channel, as the attacker uses the compromised AI agent to stage and extract sensitive information from the environment. The attack chain relies on social engineering aspects inherent in prompt injection, where the victim's trust in the automated tool is exploited to execute arbitrary code-like instructions within a sandboxed but powerful context.
Mitigation strategies must prioritize immediate updates to Context7 version 2.1.2 or later, which address these sanitization gaps. In environments where upgrading is not immediately feasible, administrators should restrict the permissions of AI coding agents to minimize the blast radius in case of exploitation. This includes limiting file system access scopes and preventing outbound network connections from development containers unless explicitly authorized. Additionally, implementing strict input validation on any custom instruction fields that accept user text can help prevent malicious payloads from being injected into the prompt context. Security teams should also monitor for unusual API calls or data exfiltration patterns originating from AI agent processes to detect potential compromises early.