---
title: Three open-source MCP servers (esp-mcp, Kali-GPT, hagent) pass agent-chosen tool arguments to a shell, so a prompt-injected agent can run commands as the server user | ctxsec
url: https://ctxsec.com/items/mcp-servers-esp-mcp-kali-gpt-hagent-shell-injection
description: ""
status: "official (NVD entries from VulnCheck, published Oct 27)"
published: 2026-10-28
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/mcp-servers-esp-mcp-kali-gpt-hagent-shell-injection.md)

official (NVD entries from VulnCheck, published Oct 27)

2026-10-28

### Three open-source MCP servers (esp-mcp, Kali-GPT, hagent) pass agent-chosen tool arguments to a shell, so a prompt-injected agent can run commands as the server user

NVD entries published Oct 27, all from VulnCheck, describe the same mistake in three MCP servers: a value the agent picks is pasted into a shell command.

- **CVE-2026-117567, esp-mcp** (through commit 28afddf): `target`, `port`, `project_path` and `project_name` reach `asyncio.create_subprocess_shell`.
- **CVE-2026-117569, Kali-GPT** (through commit a608c74): scanner parameters such as `target`, `ports`, `domain`, `wordlist` and `url` reach `subprocess.run(shell=True)` in `execute_tool()`.
- **CVE-2026-117573, hagent** (through commit 761eec6): the `args` parameter of `hagent_arduino` and `hagent_esp32` is interpolated into `arduino-cli` and `idf.py` commands run with `shell=True`.

Each entry says the flaw can be reached by an agent that has read hostile text, not just by a malicious client. **What to do:** if you run any of these, stop exposing them to agents that read untrusted content until fixed, and for your own MCP servers pass arguments as a list without a shell and validate them against what the tool expects.

Sources: [VulnCheck: esp-mcp OS command injection via MCP tool parameters (CVE-2026-117567)](https://www.vulncheck.com/advisories/esp-mcp-through-commit-28afddf-os-command-injection-via-mcp-tool-parameters) · [NVD: CVE-2026-117567](https://nvd.nist.gov/vuln/detail/CVE-2026-117567) · [NVD: CVE-2026-117569](https://nvd.nist.gov/vuln/detail/CVE-2026-117569) · [NVD: CVE-2026-117573](https://nvd.nist.gov/vuln/detail/CVE-2026-117573)