NVD entries published Oct 27, all from VulnCheck, describe the same mistake in three MCP servers: a value the agent picks is pasted into a shell command.

• CVE-2026-117567, esp-mcp (through commit 28afddf): target, port, project_path and project_name reach asyncio.create_subprocess_shell.
• CVE-2026-117569, Kali-GPT (through commit a608c74): scanner parameters such as target, ports, domain, wordlist and url reach subprocess.run(shell=True) in execute_tool().
• CVE-2026-117573, hagent (through commit 761eec6): the args parameter of hagent_arduino and hagent_esp32 is interpolated into arduino-cli and idf.py commands run with shell=True.

Each entry says the flaw can be reached by an agent that has read hostile text, not just by a malicious client. What to do: if you run any of these, stop exposing them to agents that read untrusted content until fixed, and for your own MCP servers pass arguments as a list without a shell and validate them against what the tool expects.