{"schema":"threatline.record/2","record":{"id":"CVE-2026-117573","aliases":[],"summary":"hagent through commit 761eec6 OS Command Injection via Arduino and ESP32 MCP Tools","details":"hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagent_arduino and hagent_esp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated into arduino-cli and idf.py commands run with subprocess.run(shell=True) to execute commands as the MCP server user.","categories":["Unclassified"],"product":"hagent","vendor":"masc-ucsc","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-117573","source_modified_at":"2026-10-27T13:08:03.276Z","fetched_at":"2026-10-27T16:27:21.584480Z","product":"hagent","vendor":"masc-ucsc","versions":[{"version":"0","lessThanOrEqual":"761eec627a1e6fb128a2a8ce9245aa595cc2f7af","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":8.5,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T13:08:03.276Z","modified_at":"2026-10-27T13:08:03.276Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-117573","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27T13:08:03.276Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/masc-ucsc/hagent/issues/98","tags":["issue-tracking"]},{"source":"CVE List","url":"https://github.com/masc-ucsc/hagent","tags":["product"]},{"source":"CVE List","url":"https://github.com/masc-ucsc/hagent/blob/761eec627a1e6fb128a2a8ce9245aa595cc2f7af/hagent/mcp/mcp_arduino.py#L776","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/masc-ucsc/hagent/blob/761eec627a1e6fb128a2a8ce9245aa595cc2f7af/hagent/mcp/mcp_esp32.py#L682","tags":["technical-description"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/hagent-through-commit-761eec6-os-command-injection-via-arduino-and-esp32-mcp-tools","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-27T13:08:03.276Z","content_hash":"c707a432218fbf040d1d80e8662949f9687c2485b6abd890699272d6e5f6c6c9"}}