Kali-GPT EUVD-2026-110847

Requires an active Kali-GPT MCP server and the ability to act as an MCP client invoking its scanner tools - or an AI agent connected to that server that can be prompt-injected into supplying crafted parameters. The concrete trigger is attacker control over any of the scanner parameters target, ports, domain, wordlist, or url, which execute_tool() passes to subprocess.run with shell=True unsanitized; embedding shell metacharacters (e.g. ;, |, $(), backticks) in any of these achieves command execution as the MCP server user. Limiting factors: the CVSS vector indicates a local attack vector (AV:L) and low-privilege access (PR:L), so the attacker must already be able to reach/drive the MCP server rather than exploit it as an anonymous remote host; impact is bounded by the privileges of the MCP server process. If the MCP server is deployed with network transport, the exposure would be broader than AV:L implies.

The CVSS 4.0 base score of 8.5 reflects full compromise impact (VC:H/VI:H/VA:H) with low attack complexity and no user interaction, but the vector qualifies it heavily: AV:L and PR:L mean an attacker must already be a connected MCP client (or an LLM agent reachable by the MCP server), not an arbitrary internet host. This is command injection via subprocess.run(shell=True) on unsanitized scanner parameters, so successful exploitation yields arbitrary command execution as the MCP server user - i.e. whatever privileges the Kali-GPT process holds. EPSS is not provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and there is no confirmed working public exploit, though VulnCheck published an advisory and a GitHub issue (#12) documents the flaw, so it is well-characterized publicly. The vuln.today decision label is 'this_week' - treat as a near-term patch priority, not an emergency. Net assessment: a genuinely trivial-to-exploit, high-impact flaw for anyone with MCP client access, but real-world risk is tempered by a rare, hobby-scale deployment footprint and local attack vector. One signal to verify: the CVSS vector states AV:L, yet MCP servers can be configured with network transport (SSE/HTTP) rather than local stdio - if exposed over the network the effective attack vector could be remote, so confirm the deployment's MCP transport. The prompt-injection angle also lowers the practical bar: an agent processing attacker-controlled content could be coerced into supplying malicious scanner parameters.

An attacker acting as an MCP client (or indirectly, a prompt-injected AI agent driving the Kali-GPT MCP server) invokes a scanner tool and embeds shell metacharacters in a parameter such as target, ports, domain, wordlist, or url. Because execute_tool() passes these values into subprocess.run with shell=True without sanitization, the injected commands execute as the MCP server user. No public working exploit is confirmed, but the trigger and vulnerable code path are fully documented in the VulnCheck advisory and source reference.