{"id":"CVE-2026-117569","revision":"bbc4af0acc8540fb89f02e1bf67ec0cd","records":[{"revision":"bbc4af0acc8540fb89f02e1bf67ec0cd","observedAt":"2026-10-27T15:09:21.953+00:00","statement":{"source":"cve-program","id":"CVE-2026-117569","aliases":[],"title":"Kali-GPT through commit a608c74 OS Command Injection via MCP Scanner Tool Parameters","description":"Kali-GPT through commit a608c74 contains an OS command injection vulnerability in execute_tool() in kali_gpt/tools/mcp_server.py that allows MCP clients to run commands via unsanitized scanner parameters. Attackers or prompt-injected agents can embed shell metacharacters in parameters like target, ports, domain, wordlist, or url, executed via subprocess.run with shell=True as the MCP server user.","state":0,"publishedAt":"2026-10-27T13:08:01.873+00:00","modifiedAt":"2026-10-27T13:08:01.873+00:00","affected":[{"ecosystem":"Vendor product","name":"kali-gpt","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"alishahid74\",\n                    \"product\": \"kali-gpt\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThanOrEqual\": \"a608c74e99910232dd208fee99de860458672b82\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":8.5,"severity":"HIGH"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://github.com/alishahid74/kali-gpt/issues/12","https://github.com/alishahid74/kali-gpt","https://github.com/alishahid74/kali-gpt/blob/a608c74e99910232dd208fee99de860458672b82/kali_gpt/tools/mcp_server.py#L229-L356","https://www.vulncheck.com/advisories/kali-gpt-through-commit-a608c74-os-command-injection-via-mcp-scanner-tool-parameters"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-117569","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-117569","identifiers":["CVE-2026-117569"]},"retained":false,"historicalAffected":[]}],"coverage":[]}