Kali-GPT: OS command injection via MCP scanner tool parameters

Summary

Kali-GPT through commit a608c74 contains an OS command injection flaw in the MCP server (execute_tool in kali_gpt/tools/mcp_server.py). Scanner parameters such as target, ports, domain, wordlist or url are passed unsanitized to a shell, so shell metacharacters are executed. An attacker with access to the MCP interface, or an AI agent manipulated through prompt injection, can run commands as the MCP server user.

Affected

• Kali-GPT through commit a608c74e99910232dd208fee99de860458672b82
• Affected component: kali_gpt/tools/mcp_server.py (MCP server)
• Whether later commits are affected: Unknown.

Fixed in

Unknown. No vendor fix or release found as of 1 Nov 2026.

Workaround

• Do not run the MCP server from the affected commit, or disable it if it is only used for testing.
• If it must run, use a dedicated low-privilege account in a container or VM without access to sensitive data or credentials.
• Restrict which MCP clients can connect and do not let AI agents that process untrusted content use this server.

Exploitation

• Exploited in the wild: no evidence found. Not listed in CISA KEV.
• Public proof of concept: injection demonstrations are in the upstream issue; no weaponized exploit was provided. Not indexed in Metasploit or Exploit-DB.
• CVSS 4.0 vector: local attack vector, low privileges, no user interaction.

Our recommendation

• Check whether Kali-GPT is installed and whether its MCP server is running, especially on workstations with credentials, SSH keys or client data.
• Disable the MCP server or remove the affected version until a fix is published.
• Do not expose the MCP server to networks or untrusted AI agents.
• Monitor the upstream repository for a fix. Priority is low for most SMEs unless the tool is used with AI agents on shared or internet-reachable hosts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE-2026-117569 VulnCheck advisory www.vulncheck.com
• Upstream issue #12 github.com
• Vulnerable code (mcp_server.py at a608c74) github.com
• Kali-GPT project repository github.com
• Strix CVE entry www.strix.ai
• OffSeq Radar threat entry radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:58.