Description
hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagent_arduino and hagent_esp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated into arduino-cli and idf.py commands run with subprocess.run(shell=True) to execute commands as the MCP server user.
Published: 2026-10-27
Score: 8.5 High
EPSS: n/a
KEV: No
Impact: OS Command Injection
Action: Immediate Patch
AI Analysis

Impact

hagent's MCP tools, specifically hagent_arduino and hagent_esp32, contain an OS command injection flaw that lets adversaries insert metacharacters into the args parameter. This input is passed directly to arduino-cli and idf.py via subprocess.run with the shell enabled, enabling execution of arbitrary shell commands as the MCP server user. The vulnerability is a classic CWE‑78 problem, exposing the system to command execution and potential full compromise of the underlying operating environment.

Affected Systems

The affected product is Masc‑ucsc's hagent, with the vulnerability present in the versions that include commit 761eec6. No specific version matrix is provided beyond the presence of this commit, so all affected instances of hagent carrying this code are at risk.

Risk and Exploitability

The CVSS score of 8.5 indicates a high severity impact. EPSS data is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting no known public exploitation yet. However, the flaw is exploitable by any entity able to supply crafted args to the hagent MCP tools, which may include remote attackers if the MCP server accepts external input or local users whose privileges are too high. The resulting execution occurs with the privileges of the MCP server process, potentially giving attackers full system control.

Generated by OpenCVE AI on October 27, 2026 at 14:38 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update hagent to a version where the injection issue is resolved
  • Sanitize or validate the args input before passing it to subprocess, ensuring no shell metacharacters are allowed
  • Configure subprocess.run to use shell=False or otherwise avoid shell interpolation when invoking arduino-cli and idf.py

Generated by OpenCVE AI on October 27, 2026 at 14:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Description hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagent_arduino and hagent_esp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated into arduino-cli and idf.py commands run with subprocess.run(shell=True) to execute commands as the MCP server user.
Title hagent through commit 761eec6 OS Command Injection via Arduino and ESP32 MCP Tools
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-27T13:08:03.276Z

Reserved: 2026-10-27T11:33:16.313Z

Link: CVE-2026-117573

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-27T14:16:39.800

Modified: 2026-10-27T14:16:39.800

Link: CVE-2026-117573

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T14:45:03Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')