Threats affecting pkg:github/masc-ucsc/hagent

CVE-2026-117573 is an OS command injection vulnerability in the hagent project (version 0). It allows MCP clients to execute arbitrary shell commands by injecting special characters into the args parameter of the hagent_arduino and hagent_esp32 tools. The vulnerability arises because these args are interpolated unsafely into subprocess.run calls with shell=True, enabling command execution as the MCP server user.