Context7 2.1.2 contains a prompt injection vulnerability that allows attackers to insert malicious content through the Custom AI Instructions feature. The injected instructions are served by the MCP server without proper sanitisation, enabling attackers to execute harmful commands inside the connected AI coding agents. Consequences include exfiltration of credentials stored in environment files and destructive deletion of files on the victim’s machine when the agent processes a routine library documentation request.

The vulnerability affects Uptash’s Context7 product, specifically version 2.1.2. Users running this exact version and the MCP server component are at risk unless mitigated or upgraded.

The vulnerability has a CVSS score of 6.4, indicating a moderate severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers can exploit this flaw by sending malicious custom instructions to the MCP server via an exposed API or web interface, indicating a remote avenue that does not require local privileges.