CVE Alert: CVE-2026-117569 – alishahid74 – kali

Kali-GPT through commit a608c74 contains an OS command injection vulnerability in execute_tool() in kali_gpt/tools/mcp_server.py that allows MCP clients to run commands via unsanitized scanner parameters. Attackers or prompt-injected agents can embed shell metacharacters in parameters like target, ports, domain, wordlist, or url, executed via subprocess.run with shell=True as the MCP server user.

**Risk verdict:** Treat affected deployments as high priority; KEV, SSVC exploitation, proof-of-concept and EPSS status were not provided, so active exploitation urgency cannot be confirmed.

**Why this matters:** Successful command execution can expose sensitive data, alter tools or files, and disrupt the host under the server’s account. Attackers may use an accessible MCP service—or a prompt-injected agent—to turn scanner inputs into execution, then pursue credentials or other locally accessible resources.

**Most likely attack path:** An attacker needs local access and low-level privileges to submit crafted tool parameters; no additional conditions or user interaction are indicated. Execution appears confined to the vulnerable host’s security boundary, so direct cross-boundary impact is not indicated, though stolen credentials could enable later movement.

**Who is most exposed:** Prioritise developer, security-testing and automation environments where MCP services accept requests from agents, plugins or shared clients, especially hosts with valuable credentials or broad filesystem access.

Review MCP tool-call logs for shell metacharacters or unexpected command syntax in scanner arguments.

Alert on child processes spawned by the MCP server, especially shells or commands unrelated to normal scans.

Check process and audit logs for unusual network connections, file changes or credential access by the server account.

Mitigation and prioritisation

Upgrade beyond the affected code; verify the fix removes shell interpretation and safely validates arguments.

Until patched, disable the vulnerable scanner tool or restrict MCP access to trusted, authenticated clients.

Run the service with minimal privileges and a constrained filesystem, environment and network egress.

Check upstream KEV, SSVC and EPSS data before final scheduling; expedite remediation if exploitation is confirmed.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.