hagent: OS command injection via Arduino and ESP32 MCP tools
Summary
The hagent framework through commit 761eec6 contains an OS command injection flaw in the MCP tools hagent_arduino and hagent_esp32. Crafted input in the args parameter is passed unescaped into arduino-cli and idf.py commands executed with shell=True. An MCP client or a prompt-injected AI agent can thereby run arbitrary shell commands with the privileges of the MCP server user.
Affected
- masc-ucsc hagent, all versions up to and including commit 761eec627a1e6fb128a2a8ce9245aa595cc2f7af
- Components: hagent_arduino and hagent_esp32 MCP tools
- The project has no published releases.
Fixed in
Unknown.
Workaround
- Disable the hagent_arduino and hagent_esp32 MCP tools if they are not needed.
- Connect only trusted MCP clients.
- Run the MCP server as a low-privilege user, ideally in a container without access to secrets or production networks.
- Do not expose the MCP server over the network.
- Note: These are recommendations from our own research, not vendor guidance.
Exploitation
- No evidence of exploitation in the wild is known.
- Public technical description available (GitHub issue #98); no known public proof-of-concept repository.
- CVSS 4.0 score 8.5 (AV:L, PR:L). Reports differ on CVSS 3.1 (7.8 vs. 9.8).
Our recommendation
- Inventory whether hagent or similar MCP servers are installed on developer machines, build servers or CI runners.
- Where found, apply the workarounds above and restrict access to credentials and internal networks.
- Monitor the MCP server for unexpected child processes.
- Watch the upstream repository for a fix and update as soon as one is published.
- Relevance for most SMEs is low, as hagent is a research-oriented EDA framework.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub issue #98 github.com
- VulnCheck advisory www.vulncheck.com
- hagent repository github.com
- mcp_arduino.py at commit 761eec6 github.com
- mcp_esp32.py at commit 761eec6 github.com
- Strix CVE record www.strix.ai
- OSV record (Vulners) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:00.
Original description (NVD)
hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagent_arduino and hagent_esp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated into arduino-cli and idf.py commands run with subprocess.run(shell=True) to execute commands as the MCP server user.
NVD references (5)
- https://github.com/masc-ucsc/hagent
- https://github.com/masc-ucsc/hagent/blob/761eec627a1e6fb128a2a8ce9245aa595cc2f7af/hagent/mcp/mcp_arduino.py#L…
- https://github.com/masc-ucsc/hagent/blob/761eec627a1e6fb128a2a8ce9245aa595cc2f7af/hagent/mcp/mcp_esp32.py#L682
- https://github.com/masc-ucsc/hagent/issues/98
- https://www.vulncheck.com/advisories/hagent-through-commit-761eec6-os-command-injection-via-arduino-and-esp32…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.