Threats tagged 'ghsa-j5hx-w574-wh9m'

An OS command injection vulnerability exists in hagent through commit 761eec6. This flaw allows MCP clients to execute arbitrary shell commands by injecting metacharacters into the args parameter of the hagent_arduino and hagent_esp32 tools. The vulnerability arises because crafted args are interpolated unsafely into arduino-cli and idf.py commands executed with subprocess.run(shell=True), enabling command execution with the privileges of the MCP server user.