{"data":{"id":"846a6ca3-e179-462b-937b-c1f15573d43e","title":"CVE-2026-117569: Kali-GPT through commit a608c74 contains an OS command injection vulnerability in execute_tool() in…","summary":"Kali-GPT through commit a608c74 contains an OS command injection flaw in execute_tool() in kali_gpt/tools/mcp_server.py. The function passes unsanitized scanner parameters such as target, ports, domain, wordlist, or url to subprocess.run with shell=True, so MCP clients can run commands. An attacker or a prompt-injected agent can embed shell metacharacters in these parameters, and the commands run as the MCP server user.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-117569","publishedAt":"2026-10-27T14:16:39.477Z","cveId":"CVE-2026-117569","cweIds":["CWE-78"],"cvssScore":"7.8","cvssSeverity":"high","severity":"high","attackType":["prompt_injection","supply_chain"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Kali-GPT","MCP server"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Kali-GPT OS command injection in execute_tool through MCP scanner parameters","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"local","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-27T18:10:55.614Z","kevDateAdded":null,"advisoryAliases":["GHSA-qqg8-6hv5-w2xr"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-27T18:10:59.677Z","patchAvailable":null,"disclosureDate":"2026-10-27T14:16:39.477Z","capecIds":["CAPEC-88"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0010","AML.T0051"]}}