esp-mcp: OS command injection via MCP tool parameters
Summary
esp-mcp, an MCP server for ESP-IDF workflows, is affected up to commit 28afddf. Tool parameters such as target, port, project_path and project_name are passed unsanitized to a shell command, so shell metacharacters can execute arbitrary commands as the MCP server user. An attacker who can influence agent tool calls, for example through prompt injection, can exploit this when the server runs on a machine the attacker can reach through the agent.
Affected
- horw esp-mcp through commit 28afddf9ff41ada117bb45fd49b526d3bf89749e
- Default configuration: unaffected per the CVE record (affected range applies to the stated commits)
Fixed in
Unknown. No fixed version or vendor patch found.
Workaround
- No vendor-documented mitigation found.
- Run the server only locally, under a low-privilege account or in a container without access to secrets or production networks.
- Remove the server from agent configurations where it is not needed.
- Do not let agents use it unattended on untrusted input.
Exploitation
- Not known to be exploited in the wild (as of 27 Oct 2026, per OffSeq).
- No public proof of concept identified; GitHub issue #49 was not verified.
- CVSS 4.0 8.5 (AV:L/AC:L/AT:N/PR:L/UI:N); VulnCheck CVSS 3.1 score 7.8. EPSS 0.65 %.
Our recommendation
- Check whether esp-mcp is installed on developer or engineering workstations, for example in tool inventories.
- Treat the server as unpatched; restrict it to local use with a low-privilege account or container.
- Monitor the repository and issue #49 for a fix and update when one is available.
- Assess other MCP servers in use the same way.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- esp-mcp GitHub repository github.com
- main.py at commit 28afddf github.com
- esp-mcp issue #49 github.com
- VulnCheck advisory www.vulncheck.com
- OSV record CVE-2026-117567 vulners.com
- OffSeq radar entry CVE-2026-117567 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:57.
Original description (NVD)
esp-mcp through commit 28afddf contains an OS command injection vulnerability that allows attackers to run arbitrary commands by supplying shell metacharacters in MCP tool parameters. Attackers influencing agent tool calls through prompt injection can inject metacharacters into target, port, project_path, or project_name values passed to asyncio.create_subprocess_shell, executing commands as the MCP server user.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.