Critical Command Injection Vulnerabilities in MCP Tools

• •Critical command injection vulnerabilities found in esp_mcp and hagent tools.
• •Both vulnerabilities have a CVSS score of 9.8, indicating severe risk.
• •No patches have been released, leaving systems potentially exposed.

Two separate command injection vulnerabilities have been identified in multiple MCP tools, affecting both esp_mcp and hagent. The vulnerabilities allow attackers to inject arbitrary shell commands through user-controlled parameters, with a CVSS score of 9.8, indicating critical severity. The esp_mcp tools expose six injectable parameters, while the hagent tools have five, all of which are executed without proper sanitization. Attackers can exploit these vulnerabilities via parameters such as target, port, and args, leading to potential system compromise. Developers had implemented some sanitization measures for certain parameters but failed to do so for others. As of today, there is no indication of a patch being released for these vulnerabilities. Security professionals are advised to assess their systems for exposure to these vulnerabilities.