Description
Kali-GPT through commit a608c74 contains an OS command injection vulnerability in execute_tool() in kali_gpt/tools/mcp_server.py that allows MCP clients to run commands via unsanitized scanner parameters. Attackers or prompt-injected agents can embed shell metacharacters in parameters like target, ports, domain, wordlist, or url, executed via subprocess.run with shell=True as the MCP server user.
Published: 2026-10-27
Score: 8.5 High
EPSS: n/a
KEV: No
Impact: Command execution via OS command injection
Action: Patch immediately
AI Analysis

Impact

Kali‑GPT contains an OS command injection flaw where unsanitized parameters such as target, ports, domain, wordlist, or url are passed to subprocess.run with shell=True inside execute_tool(). An attacker or a prompt‑injected agent can embed shell metacharacters in these parameters, causing arbitrary OS commands to run as the MCP server user and potentially leading to full system compromise.

Affected Systems

The vulnerability targets the Kali‑GPT project, specifically the MCP Server component developed by alishahid74. It is present in any deployment that includes commit a608c74 of the codebase; no additional vendors or products are listed in the CNA data, making the affected scope limited to users running this particular commit.

Risk and Exploitability

The CVSS Base score of 8.5 denotes high severity. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog, implying limited observed exploitation. The flaw is remotely exploitable by any MCP client that can send scanner parameters to the server; the required action is merely to supply crafted parameter values. Since the malicious command executes with the privileges of the MCP server process, a successful injection grants full control over the host where the server runs.

Generated by OpenCVE AI on October 27, 2026 at 14:39 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Kali‑GPT to a version that removes the vulnerable execute_tool() logic introduced in commit a608c74.
  • If an update is not immediately possible, modify execute_tool() to invoke subprocess.run without shell=True and enforce strict validation or escaping of all scanner parameters to eliminate shell metacharacter execution.
  • Restrict MCP client connections to trusted hosts or apply network segmentation so that only authorized clients can communicate with the MCP server, thereby reducing the attack surface.

Generated by OpenCVE AI on October 27, 2026 at 14:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Description Kali-GPT through commit a608c74 contains an OS command injection vulnerability in execute_tool() in kali_gpt/tools/mcp_server.py that allows MCP clients to run commands via unsanitized scanner parameters. Attackers or prompt-injected agents can embed shell metacharacters in parameters like target, ports, domain, wordlist, or url, executed via subprocess.run with shell=True as the MCP server user.
Title Kali-GPT through commit a608c74 OS Command Injection via MCP Scanner Tool Parameters
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-27T13:08:01.873Z

Reserved: 2026-10-27T11:25:26.494Z

Link: CVE-2026-117569

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-27T14:16:39.477

Modified: 2026-10-27T14:16:39.477

Link: CVE-2026-117569

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T14:45:03Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')