# Nine MCP servers: tool parameters reach the shell

> MCP servers that wrap a command-line tool turn an agent's arguments into shell commands when they build the command as a string.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** VulnCheck
- **Disclosed:** 2026-10-27
- **CVE:** CVE-2026-117569
- **CVSS:** 8.5
- **Affects:** Kali-GPT, mcp-ffmpeg, esp-mcp, sf-mcp, DroidMind, hagent, ai-sdlc, ATXP Gemini CLI extension, nmap-mcp
- **Research by:** Nguyễn Văn Tiến
- **Primary source:** https://www.vulncheck.com/advisories/kali-gpt-through-commit-a608c74-os-command-injection-via-mcp-scanner-tool-parameters
- **Page:** https://theinjection.dev/items/vulncheck-mcp-tool-parameter-command-injection/

Nine MCP servers that wrap command-line tools pass model-supplied parameters into a shell, in VulnCheck advisories published on October 27, 2026. Eight are command injection at CVSS 7.3 to 8.5. None names a fixed version.

## What happened

VulnCheck published nine advisories for MCP servers on October 27, 2026. Eight are OS command injection rated CVSS 7.3 to 8.5, and the ninth is a permissive nmap script allowlist rated 4.8. The servers wrap tools such as nmap, ffmpeg, the Salesforce CLI, arduino-cli and adb, and VulnCheck credits Nguyễn Văn Tiến on the advisories that name a researcher.

## How it works

Each server builds one shell command string from values the model controls, then runs it through a shell: subprocess.run with shell=True in Kali-GPT and hagent, asyncio.create_subprocess_shell in esp-mcp, child_process.exec in mcp-ffmpeg, and execSync in sf-mcp and the ai-sdlc plugin. A backtick or a $() substitution inside a parameter such as target, ports, videoPath or repo ends the intended command and starts a second one, which runs as the MCP server user. DroidMind checks the command name against an allowlist but not the substitutions inside its arguments.

## Who is affected

Operators who connect an agent to one of the nine servers listed below are exposed, at the versions and commits the advisories name. A caller needs only to influence a tool call, and several advisories name prompt-injected agents as the expected path, so content an agent reads is enough.

## What to do

Disconnect or isolate these servers until their maintainers ship a fix, because no advisory names a patched version. Review any community MCP server that shells out to a CLI for shell=True, exec or execSync with interpolated arguments, pass arguments as a list rather than a string, and run tool wrappers as a user that holds no credentials.

## Quick facts

- **Affected:** ai-sdlc plugin <=0.31.2, DroidMind <=0.4.0, ATXP Gemini CLI extension <=1.0.0, sf-mcp <=1.3.2, mcp-ffmpeg <=1.0.5, esp-mcp (28afddf), Kali-GPT (a608c74), nmap-mcp (3636afa), hagent (761eec6)
- **CVEs:** CVE-2026-117558, 117559, 117560, 117561, 117567, 117568, 117569, 117570, 117573
- **CVSS:** 4.8 to 8.5, CVSS v4.0, from NVD and VulnCheck
- **Fixed in:** No patched version in any of the nine advisories
- **Found by:** Nguyễn Văn Tiến, credited on the Kali-GPT, mcp-ffmpeg and esp-mcp advisories
- **Attack type:** OS command injection through MCP tool parameters; one permissive nmap script allowlist
- **Disclosed:** October 27, 2026

## Questions

### Which MCP servers are affected by the October 27 command injection advisories?

VulnCheck names nine servers: the ai-sdlc plugin MCP server, DroidMind, the ATXP Gemini CLI extension, Codefriar sf-mcp, esp-mcp, mcp-ffmpeg, Kali-GPT, Vorota-ai nmap-mcp and hagent. Eight share one root cause, a shell command built from model-supplied arguments. The ninth, nmap-mcp, instead lets a caller pass blocked nmap script categories such as exploit, dos or brute.

### Is there a patch for these MCP command injection CVEs?

No advisory in the set names a patched version, and the GitHub Advisory Database lists patched versions as unknown for all nine. Treat every listed server as exposed: remove it from agent configurations, or run it somewhere command execution gains an attacker nothing. Each advisory links the GitHub issue filed against the project, which is where a fix would appear.

### Can prompt injection trigger these MCP command injections?

Yes. Each flaw needs one tool call with a crafted argument, so any content an agent reads can supply it, and the esp-mcp, Kali-GPT, DroidMind and ai-sdlc advisories name prompt-injected agents as an expected path. VulnCheck's CVSS v4 vectors use a local attack vector with low privileges, which matches an agent already connected to the server.

## Sources

1. [VulnCheck Kali-GPT](https://www.vulncheck.com/advisories/kali-gpt-through-commit-a608c74-os-command-injection-via-mcp-scanner-tool-parameters)
2. [VulnCheck mcp-ffmpeg](https://www.vulncheck.com/advisories/mcp-ffmpeg-through-1.0.5-os-command-injection-via-videopath-and-outputdir)
3. [VulnCheck esp-mcp](https://www.vulncheck.com/advisories/esp-mcp-through-commit-28afddf-os-command-injection-via-mcp-tool-parameters)
4. [Kali-GPT Advisory](https://github.com/advisories/GHSA-qqg8-6hv5-w2xr)
5. [mcp-ffmpeg Advisory](https://github.com/advisories/GHSA-cqrv-cwxw-xcq4)
6. [sf-mcp Advisory](https://github.com/advisories/GHSA-rjw8-q97p-7xhf)
7. [DroidMind Advisory](https://github.com/advisories/GHSA-533h-cccj-x6hp)
8. [ATXP Extension](https://github.com/advisories/GHSA-w542-83fj-2ghf)
9. [hagent Advisory](https://github.com/advisories/GHSA-j5hx-w574-wh9m)
10. [nmap-mcp Advisory](https://github.com/advisories/GHSA-65g8-vjqh-r7qc)
11. [ai-sdlc Advisory](https://github.com/advisories/GHSA-f89j-j8x9-5xwf)