Threats tagged 'ghsa-3w6w-vpcf-fv9h'

An OS command injection vulnerability exists in esp-mcp through commit 28afddf. This flaw allows attackers to execute arbitrary commands by injecting shell metacharacters into parameters used by the MCP tool. Specifically, attackers can influence agent tool calls via prompt injection to pass malicious values to asyncio.create_subprocess_shell, resulting in command execution with the MCP server user's privileges.