What is the CVSS score of CVE-2026-58195?

CVE-2026-58195 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Agentic-Flow are affected by CVE-2026-58195?

Agentic-Flow (npm: ruvnet/agentic-flow before 2.0.14), a widely-used AI agent orchestration platform, contains a high-severity command injection vulnerability with publicly available exploit code…. A patch is available.

How to fix or mitigate CVE-2026-58195?

Immediately conduct a 24-hour inventory of all systems running Agentic-Flow versions before 2.0.14, document network exposure, and implement network segmentation to restrict MCP server HTTP/SSE interface access to trusted networks only. Within 7 days, deploy monitoring for suspicious process execution and network activity from the MCP server process, run the MCP server with a dedicated least-privilege service account, and enable process sandboxing where feasible. Within 30 days, enforce strict input validation on MCP tool parameters (agent, task, name, language, agentdb) at the application level, and establish a vendor-watch and patching protocol to deploy fixes immediately upon release.

Agentic-Flow CVE-2026-58195

EUVD-2026-45256 HIGH

OS Command Injection (CWE-78)

2026-07-17 GitHub_M

Command Injection Agentic Flow

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Untrusted content must reach the tool (UI:R) but no auth is required on the exposed sinks (PR:N); trivial injection (AC:L) yields full OS control (C/I/A:H) as the server user.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 17, 2026 - 20:03 EUVD

Source Code Evidence Fetched

Jul 17, 2026 - 19:17 vuln.today

Analysis Generated

Jul 17, 2026 - 19:17 vuln.today

CVE Published

Jul 17, 2026 - 18:47 cve.org

HIGH 8.8

DescriptionCVE.org

Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools in src/mcp/standalone-stdio.ts, src/mcp/fastmcp/servers/claude-flow-sdk.ts, src/mcp/fastmcp/servers/stdio-full.ts, src/mcp/fastmcp/servers/http-streaming-updated.ts, src/mcp/fastmcp/servers/http-sse.ts, src/mcp/fastmcp/servers/poc-stdio.ts, src/mcp/fastmcp/tools/agent/{execute,list,parallel}.ts, src/mcp/fastmcp/tools/swarm/orchestrate.ts, and src/mcp/fastmcp/tools/hooks/pretrain.ts interpolated attacker-influenceable tool parameters such as agent, task, name, language, and agentdb directly into shell command strings passed to execSync(), allowing arbitrary OS command execution with the privileges of the MCP server user. This issue is fixed in version 2.0.14.

AnalysisAI

OS command injection in Agentic-Flow (npm package ruvnet/agentic-flow) before 2.0.14 lets attacker-controlled MCP tool parameters - agent, task, name, language, and agentdb - break out of double-quoted shell arguments and run arbitrary OS commands as the MCP server user. The AI-orchestration platform's MCP server tools interpolated these values straight into strings passed to execSync(), so any untrusted content (web pages, files, third-party tool output) that the agent processes can reach the sink, and the HTTP/SSE transports expose the same sinks over the network without authentication. A working proof of concept is published in the vendor's GHSA advisory; there is no evidence of active in-the-wild exploitation (not in CISA KEV).

Technical ContextAI

Agentic-Flow is a Node.js/TypeScript AI-agent orchestration platform that ships an MCP (Model Context Protocol) server exposing tools the LLM can call. The flaw is a classic CWE-78 (OS Command Injection): affected files (src/mcp/standalone-stdio.ts, the fastmcp servers claude-flow-sdk.ts, stdio-full.ts, http-streaming-updated.ts, http-sse.ts, poc-stdio.ts, and the agent/swarm/hooks tool modules) built shell command strings via template interpolation - e.g. npx --yes agentic-flow --agent "${agent}" --task "${task}" - and passed them to child_process.execSync(), which runs the string through /bin/sh. Because the parameters are placed inside double quotes without escaping, a value containing " and shell metacharacters (;, backticks, $()) escapes the quoting and injects commands. The vendor notes this was a partial-fix gap: an earlier commit 6a06854 (#158) remediated CWE-78 elsewhere but missed the MCP server files. The 2.0.14 fix replaces execSync with execFileSync using argv arrays and shell:false, so each user value stays a discrete argv element that the shell cannot reinterpret. Per CPE cpe:2.3:a:ruvnet:agentic-flow, only the ruvnet agentic-flow product is affected.

RemediationAI

Vendor-released patch: upgrade agentic-flow to 2.0.14 or later (npm install agentic-flow@^2.0.14), which replaces execSync template-string interpolation with execFileSync argv arrays and shell:false; downstream ruflo users should move to 3.12.4, which requires agentic-flow >=2.0.14. The fix is delivered in PR https://github.com/ruvnet/agentic-flow/pull/170 (commit 0c2ec967736a8b6b85832c6bae2a3e74989705ec) and ruflo PR https://github.com/ruvnet/ruflo/pull/2415; see advisory GHSA-vcv2-r9jh-99m5 for details. If immediate patching is not possible, do not expose the HTTP/SSE MCP transports (http-sse.ts, http-streaming-updated.ts) on any reachable network interface - bind them to localhost only and place them behind an authenticating reverse proxy that validates Origin/Host, since the advisory confirms these transports lack authentication (trade-off: breaks remote MCP clients that relied on direct network access). Additionally restrict what untrusted content the agent processes and avoid feeding third-party web/file/tool output into the affected tools (agent, task, name, language, agentdb), and run the MCP server as a low-privilege, sandboxed user to limit blast radius (trade-off: does not close the injection, only reduces impact).