The vulnerability in Agent Zero 0.9.8 allows an attacker to supply a malicious JSON configuration for MCP Servers that includes arbitrary command and argument values. The application executes these values without adequate validation or restriction, enabling the attacker to run arbitrary operating system commands with the privileges of the Agent Zero process. This is an example of OS command injection, classified as CWE-77. The impact is the compromise of confidentiality, integrity, and availability of the system where Agent Zero is running.

The affected product is Agent Zero, version 0.9.8.

The CVE is assessed as a remote code execution risk. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The exploit requires an attacker to supply a malicious MCP configuration file or object that the application will apply; thus, the attack vector is inferred to involve any entity that can influence the configuration, potentially local or remote depending on the deployment. Successful exploitation would provide full control of the host system with the same privileges as the Agent Zero process.