Nine MCP servers: tool parameters reach the shell

01What happened

VulnCheck published nine advisories for MCP servers on October 27, 2026. Eight are OS command injection rated CVSS 7.3 to 8.5, and the ninth is a permissive nmap script allowlist rated 4.8. The servers wrap tools such as nmap, ffmpeg, the Salesforce CLI, arduino-cli and adb, and VulnCheck credits Nguyễn Văn Tiến on the advisories that name a researcher.

02How it works

Each server builds one shell command string from values the model controls, then runs it through a shell: subprocess.run with shell=True in Kali-GPT and hagent, asyncio.create_subprocess_shell in esp-mcp, child_process.exec in mcp-ffmpeg, and execSync in sf-mcp and the ai-sdlc plugin. A backtick or a $() substitution inside a parameter such as target, ports, videoPath or repo ends the intended command and starts a second one, which runs as the MCP server user. DroidMind checks the command name against an allowlist but not the substitutions inside its arguments.

03Who is affected

Operators who connect an agent to one of the nine servers listed below are exposed, at the versions and commits the advisories name. A caller needs only to influence a tool call, and several advisories name prompt-injected agents as the expected path, so content an agent reads is enough.

04What to do

Disconnect or isolate these servers until their maintainers ship a fix, because no advisory names a patched version. Review any community MCP server that shells out to a CLI for shell=True, exec or execSync with interpolated arguments, pass arguments as a list rather than a string, and run tool wrappers as a user that holds no credentials.

Questions people ask

Which MCP servers are affected by the October 27 command injection advisories?

VulnCheck names nine servers: the ai-sdlc plugin MCP server, DroidMind, the ATXP Gemini CLI extension, Codefriar sf-mcp, esp-mcp, mcp-ffmpeg, Kali-GPT, Vorota-ai nmap-mcp and hagent. Eight share one root cause, a shell command built from model-supplied arguments. The ninth, nmap-mcp, instead lets a caller pass blocked nmap script categories such as exploit, dos or brute.

Is there a patch for these MCP command injection CVEs?

No advisory in the set names a patched version, and the GitHub Advisory Database lists patched versions as unknown for all nine. Treat every listed server as exposed: remove it from agent configurations, or run it somewhere command execution gains an attacker nothing. Each advisory links the GitHub issue filed against the project, which is where a fix would appear.

Can prompt injection trigger these MCP command injections?

Yes. Each flaw needs one tool call with a crafted argument, so any content an agent reads can supply it, and the esp-mcp, Kali-GPT, DroidMind and ai-sdlc advisories name prompt-injected agents as an expected path. VulnCheck's CVSS v4 vectors use a local attack vector with low privileges, which matches an agent already connected to the server.

Sources 11 links, all fetched

1. 1vulncheck.comVulnCheck Kali-GPT
2. 2vulncheck.comVulnCheck mcp-ffmpeg
3. 3vulncheck.comVulnCheck esp-mcp
4. 4github.comKali-GPT Advisory
5. 5github.commcp-ffmpeg Advisory
6. 6github.comsf-mcp Advisory
7. 7github.comDroidMind Advisory
8. 8github.comATXP Extension
9. 9github.comhagent Advisory
10. 10github.comnmap-mcp Advisory
11. 11github.comai-sdlc Advisory