ATXP Gemini CLI Extension: OS command injection via MCP tool parameters
Summary
The ATXP Gemini CLI extension through version 1.0.0 contains an OS command injection flaw in the function runAtxp(). Unsanitised parameters of MCP tools are passed to the shell, so an attacker can run commands with the privileges of the user. An attacker can place instructions in email or SMS content that the agent then processes, injecting shell substitutions such as $() or backticks into parameters like message_id, subject or query.
Affected
- ATXP Gemini CLI extension (atxp gemini-cli-extension), versions 0 to 1.0.0 according to the CNA record
- Note: one aggregator lists a conflicting version range; verify against the CVE JSON
Fixed in
Unknown. No fixed version or vendor advisory has been identified.
Workaround
- No vendor workaround known.
- Remove or disable the extension on systems where it is not strictly required.
- Do not let agents with this extension process untrusted email or SMS content.
- Limit the privileges and stored secrets of the account on which the agent runs.
Exploitation
- Not known to be exploited in the wild; not listed in CISA KEV (as of 27 Oct 2026).
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Public proof of concept: Unknown.
- EPSS: about 0.65 % (percentile 51).
Our recommendation
- Check whether the ATXP Gemini CLI extension is installed on any workstation or server.
- Remove the extension where it is not required.
- Where it is used, prevent the agent from processing untrusted email or SMS content and restrict the access rights of the account.
- Monitor the GitHub issue and the repository for a fix and apply it as soon as it is available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-117560 on Strix www.strix.ai
- VulnCheck Advisory www.vulncheck.com
- ATXP GitHub repository github.com
- Vulnerable code in src/server.ts github.com
- ATXP GitHub issue 15 github.com
- ThreatInt CVE record cve.threatint.com
- OffSeq Radar threat entry radar.offseq.com
- CISA KEV status via third-party tracker github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:01.
Original description (NVD)
ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows attackers to execute shell commands through unsanitized MCP tool parameters. Attackers can plant instructions in email or SMS content to inject $() or backtick substitutions into parameters like message_id, subject, or query, running commands as the user.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.