Vulnerability Description
hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagent_arduino and hagent_esp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated into arduino-cli and idf.py commands run with subprocess.run(shell=True) to execute commands as the MCP server user.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/masc-ucsc/hagent
- https://github.com/masc-ucsc/hagent/blob/761eec627a1e6fb128a2a8ce9245aa595cc2f7a
- https://github.com/masc-ucsc/hagent/blob/761eec627a1e6fb128a2a8ce9245aa595cc2f7a
- https://github.com/masc-ucsc/hagent/issues/98
- https://www.vulncheck.com/advisories/hagent-through-commit-761eec6-os-command-in
FAQ
What is CVE-2026-117573?
CVE-2026-117573 is a vulnerability with a CVSS score of 7.8 (HIGH). hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagent_arduino...
How severe is CVE-2026-117573?
CVE-2026-117573 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-117573?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.