Threats tagged 'ghsa-qqg8-6hv5-w2xr'

Kali-GPT contains an OS command injection vulnerability in the execute_tool() function within kali_gpt/tools/mcp_server.py. This flaw allows MCP clients to execute arbitrary shell commands by injecting shell metacharacters into parameters such as target, ports, domain, wordlist, or url. The vulnerability arises because these parameters are passed unsanitized to subprocess.run with shell=True, running with the MCP server user's privileges.