https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-29T05:34:31.519985+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-117567 fkie_cve-2026-117567 2026-10-29T05:34:31.541101+00:00

esp-mcp through commit 28afddf contains an OS command injection vulnerability that allows attackers to run arbitrary commands by supplying shell metacharacters in MCP tool parameters. Attackers influencing agent tool calls through prompt injection can inject metacharacters into target, port, project_path, or project_name values passed to asyncio.create_subprocess_shell, executing commands as the MCP server user.

 https://db.gcve.eu/vuln/ghsa-3w6w-vpcf-fv9h GHSA-3w6w-vpcf-fv9h 2026-10-29T05:34:31.541162+00:00

esp-mcp through commit 28afddf contains an OS command injection vulnerability that allows attackers to run arbitrary commands by supplying shell metacharacters in MCP tool parameters. Attackers influencing agent tool calls through prompt injection can inject metacharacters into target, port, project_path, or project_name values passed to asyncio.create_subprocess_shell, executing commands as the MCP server user.