A caller controls a value passed to an esp-mcp tool. The tool forms a shell command from that value and invokes a command processor, giving the injected argument the possibility of running code with the MCP process identity. CVE-2026-117567 describes OS command injection in esp-mcp code through commit 28afddf. The scope of consequence is the tool host’s…
Inspect the ClaimsCase · DiggingBeagle record
esp-mcp passed tool arguments into a shell under the MCP server’s privileges
Untrusted MCP tool input reached shell construction instead of staying within a safely quoted operation.
Scope
Reachability and permissions depend on which MCP tools were exposed to a given agent or caller.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- AI role
- AGAINST AI
Basis and provenance
The advisory names a concrete subprocess_shell argument path through commit 28afddf and identifies attacker-influenced MCP fields. Affected packaged versions and patched versions are explicitly unknown in the reviewed advisory, so no fixed release or field victim can be asserted. Impact is left ungraded because a calibrated 0-to-4 impact basis for actual affected targets is unavailable from these Claims.
Assessed Oct 28, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP22-021-A · CLM-CP22-021-B · CLM-ENRICH-20261028-006 · esp-mcp MCP argument command injection advisory
At a glance
No field victim count or verified lateral movement is established by the published advisory.
Limits and uncertaintyFull account
A caller controls a value passed to an esp-mcp tool. The tool forms a shell command from that value and invokes a command processor, giving the injected argument the possibility of running code with the MCP process identity.
CVE-2026-117567 describes OS command injection in esp-mcp code through commit 28afddf. The scope of consequence is the tool host’s own privileges, not automatic elevation to unrelated machines or a documented mass exploitation event. Primary evidence.
Reachability and permissions depend on which MCP tools were exposed to a given agent or caller.
Pass tool inputs as non-shell arguments or fixed RPC parameters, validate command enums and run the MCP server with narrowly scoped host privileges.
Claims & evidence
CLM-CP22-021-ACVE-2026-117567 describes OS command injection in esp-mcp code through commit 28afddf.supported
Basis: reported finding
- supportsesp-mcp MCP argument command injection advisoryprimary disclosure
Advisory; vulnerable commit range and OS command injection
CLM-CP22-021-BThe scope of consequence is the tool host’s own privileges, not automatic elevation to unrelated machines or a documented mass exploitation event.supported
Basis: reported finding
- supportsesp-mcp MCP argument command injection advisoryprimary disclosure
Advisory; attack requirements and impact description
CLM-ENRICH-20261028-006The published GitHub advisory does not identify a patched version and marks the affected version range unknown; it associates shell injection with target, port, project_path and project_name arguments.supported
Basis: reported finding
- supportsesp-mcp MCP argument command injection advisoryprimary disclosure
Affected versions, Patched versions and Description, CVE-2026-117567
Controls and mitigations
- Pass tool inputs as non-shell arguments or fixed RPC parameters, validate command enums and run the MCP server with narrowly scoped host privileges.
Unknowns and contradictions
- No field victim count or verified lateral movement is established by the published advisory.
Sources and citation
Material revision history
- Oct 28, 2026 · Canonical change recorded · new in release · revision 199