Threats affecting pkg:github/horw/esp-mcp

CVE-2026-117567 is an OS command injection vulnerability in esp-mcp (horw project) up to commit 28afddf. It allows attackers to execute arbitrary OS commands by injecting shell metacharacters into parameters used by the MCP tool. The vulnerability arises when attacker-controlled input is passed to asyncio.create_subprocess_shell without proper sanitization, enabling command execution as the MCP server user.