Skip to main content

Context7 MCP Server CVE-2026-75130

| EUVDEUVD-2026-61099 MEDIUM
2026-08-18 disclosure@vulncheck.com GHSA-97r6-3rgm-v39r
Code Injection
6.4
CVSS 4.0 · Vendor: vulncheck
Share

Severity by source

Vendor (vulncheck) PRIMARY
6.4 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.0 CRITICAL

PR:L reflects required write access to Custom AI Instructions; S:C and high C/I/A reflect impact on agent and victim machine, not Context7 server.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
P
Scope
X

Lifecycle Timeline

1
Analysis Generated
Aug 18, 2026 - 18:37 vuln.today

DescriptionCVE.org

Context7 through 2.1.2 contains a prompt injection vulnerability that allows attackers to execute malicious instructions in connected AI coding agents by injecting unsanitized content through the Custom AI Instructions feature served via the MCP server. Attackers can poison the custom instructions to exfiltrate credentials from environment files to an attacker-controlled service and perform destructive file deletion on the victim's machine when the agent makes a routine library documentation request.

AnalysisAI

Prompt injection in Context7 through version 2.1.2 allows an attacker with low-level write access to the Custom AI Instructions configuration to plant malicious directives that hijack connected AI coding agents when those agents make routine library documentation requests via the MCP server. The poisoned instructions cause the agent to exfiltrate credentials from environment files (such as .env files containing API keys and tokens) to an attacker-controlled endpoint, and to perform destructive file deletion on the victim developer's machine. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Gain low-privileged access to Context7 config
Delivery
Inject malicious prompt into Custom AI Instructions
Exploit
Victim agent makes routine documentation request
Execution
Context7 serves poisoned instructions to agent
Persist
Agent reads environment files and exfiltrates credentials
Impact
Agent executes destructive file deletion
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires two concrete prerequisites: first, the attacker must have low-privileged write access to the Custom AI Instructions configuration on the Context7 MCP server (PR:L), which may be an authenticated user account, a compromised plugin, or a misconfigured shared instance; second, a victim's AI coding agent must make at least one routine library documentation request through Context7 after the instructions have been poisoned (UI:P - passive interaction, no social engineering required beyond normal developer workflow). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 6.4 moderately understates operational risk because it reflects the server-side impact accurately (none), but the downstream blast radius - credential theft and file destruction on developer workstations - is the actual damage vector and is rated High across all three subsequent-system metrics. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with write access to a Context7 instance's Custom AI Instructions configuration injects a payload instructing the AI agent to read all .env files in the current working directory and POST their contents to an attacker-controlled webhook. The next time a developer's AI coding agent (e.g., Cursor, VS Code Copilot) calls Context7 for routine library documentation, the poisoned instructions are silently delivered alongside legitimate content. …
Remediation No vendor-released patch version has been independently confirmed at time of analysis - the VulnCheck advisory at https://www.vulncheck.com/advisories/context7-prompt-injection-via-custom-ai-instructions and the noma.security disclosure at https://noma.security/blog/contextcrush-context7-the-mcp-server-vulnerability/ should be monitored for patch availability and exact fix version. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Share

CVE-2026-75130 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy