CVE-2026-58195 is an OS command injection vulnerability (CWE-78) in the ruvnet agentic-flow product. Prior to version 2.0.14, several MCP server tools interpolate user-influenced parameters such as agent, task, name, language, and agentdb directly into shell command strings passed to Node.js execSync(). This improper neutralization of special elements enables an attacker to execute arbitrary OS commands with the privileges of the MCP server user. The vulnerability affects multiple source files related to standalone stdio, fastmcp servers, and orchestration tools. The issue is resolved in agentic-flow version 2.0.14.

Successful exploitation allows an unauthenticated remote attacker (no privileges required) to execute arbitrary operating system commands with the privileges of the MCP server user. This can lead to full system compromise, including confidentiality, integrity, and availability impacts. The CVSS 3.1 base score is 8.8 (high severity) reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Upgrade agentic-flow to version 2.0.14 or later, where this OS command injection vulnerability is fixed. There is no official patch or workaround available for earlier versions. Until upgraded, avoid exposing MCP server tools to untrusted input or users. Patch status is not explicitly confirmed beyond the fix in 2.0.14; check vendor advisories for updates.