{"data":{"id":"9743bf0a-6dd0-455b-be4d-9e4a7b76957f","title":"GHSA-vcv2-r9jh-99m5: Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync","summary":"agentic-flow versions <= 2.0.13 interpolated MCP tool parameters such as agent, task, name, language and agentdb arguments directly into shell command strings passed to execSync(). A malicious value can break out of the double-quoted argument and run arbitrary OS commands with the privileges of the user running the MCP server. The HTTP/SSE transports expose the same sinks without authentication or Origin/Host validation.","solution":"Fixed in agentic-flow@2.0.14, which rewrites every affected call site to use execFileSync(file, argv, { shell: false }). Upgrade to agentic-flow >= 2.0.14. There is no in-product configuration that mitigates this without upgrading.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-vcv2-r9jh-99m5","publishedAt":"2026-06-19T15:12:58.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["agentic-flow@<= 2.0.13 (fixed: 2.0.14)"],"affectedPackageNames":["agentic-flow"],"affectedPackageRefs":["npm:agentic-flow"],"affectedVendors":[],"affectedVendorsRaw":["agentic-flow","MCP server","claude-flow","ruflo"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-vcv2-r9jh-99m5"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-06-19T15:12:58.000Z","fixReleasedAt":"2026-06-18T14:22:52.305Z","daysToFix":-1,"fixCheckedAt":"2026-10-29T21:34:13.527Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"agentic-flow","fixedVersion":"2.0.14","matchedVersion":"2.0.14","fixReleasedAt":"2026-06-18T14:22:52.305Z","daysToFix":-1,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:34:13.380Z"}]}}