esp-mcp CVE-2026-117567

Exploitation requires a running esp-mcp instance (through commit 28afddf) wired to an LLM agent whose tool calls an attacker can influence - typically via prompt injection - such that attacker-controlled shell metacharacters reach the target, port, project_path, or project_name parameters that esp-mcp passes to asyncio.create_subprocess_shell (main.py line 80). Limiting factors: the CVSS vector is AV:L (local), the agent must actually expose these tools and accept attacker-influenced input, and PR:L indicates some privilege/access to the MCP tool interface is needed; there is no network-facing default-configuration path and no fixed version is identified in the supplied data, so updating guidance cannot be stated from this input.

Signals are mixed and point to a real but non-urgent, narrowly-scoped issue. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) describes a local, low-complexity flaw requiring some privilege and no user interaction, with high impact to confidentiality, integrity and availability of the vulnerable system (VC:H/VI:H/VA:H) and no subsequent-system impact (SC/SI/SA:N); CVSS score is 8.5 (High). The vuln.today Decision label is this_week, i.e. prioritize but not an emergency. No EPSS score and no KEV status were supplied, so exploitation probability and active-exploitation status cannot be quantified from this data; absence of KEV means there is no confirmation of in-the-wild use. A VulnCheck advisory and a GitHub issue (#49) are referenced, but the input does not flag confirmed working exploit code, so this should be treated as public technical disclosure rather than a verified weaponized exploit. The key tension is the AV:L (local) rating versus the real trigger: exploitation is driven by prompt injection into an LLM agent's tool calls, meaning the 'local' vector actually masks an indirect, attacker-influenced input path through the agent - verify this framing against the VulnCheck advisory. Overall this is a genuine command-injection flaw worth patching promptly, but the real-world footprint of the affected product sharply limits aggregate risk.

An attacker who can influence an LLM agent's inputs (e.g., via prompt injection in a document or web content the agent processes) induces the agent to call an esp-mcp tool with shell metacharacters embedded in the target, port, project_path, or project_name parameter. Because these values are passed to asyncio.create_subprocess_shell without sanitization, the injected commands execute as the MCP server user. Public advisory and issue references describe the flaw, but the input does not confirm verified working exploit code.